Skip to content
Critical PHP2Shell Vulnerabilities

Critical PHP2Shell Vulnerabilities

First seen 28 Oct 2026, 16:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 19:41 UTC
  • •PHP2Shell vulnerabilities allow unauthenticated remote code execution with CVSS 9.2.
  • •CISA added the vulnerabilities to its KEV catalog on October 26, indicating active exploitation.
  • •Organizations must patch PHP installations immediately to mitigate risks.

On October 21, 2026, the PHP Foundation released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, which allow unauthenticated remote code execution. These flaws affect PHP installations across various web servers, including Apache mod_php, PHP-FPM, and LiteSpeed, with a CVSS score of 9.2. Following the disclosure, exploitation attempts surged, with CISA adding these vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26. Reports indicate that attackers can execute arbitrary code and potentially access sensitive information from PHP process memory. Organizations are urged to patch immediately and verify PHP versions, as the vulnerabilities remain active and pose significant risks to web applications. The urgency is underscored by the rapid increase in exploitation attempts observed by security researchers and firms, including Cloudflare and Amazon Threat Intelligence.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-14
Public exploit for CVE-2026-46300 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-13
CVE-2026-96951 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
PHP vulnerabilities disclosed
PHP Foundation released patches for CVE-2026-109618 and CVE-2026-109619, rated 9.2 CVSS.
Threatlocker
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-24
Public exploit for CVE-2026-115560 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-26
CISA adds vulnerabilities to KEV
CISA confirmed active exploitation of PHP2Shell vulnerabilities, setting a patch deadline for federal agencies.
Mlq.Ai
2026-10-28
Exploitation confirmed
CISA and independent researchers reported successful exploitation attempts of PHP2Shell vulnerabilities.
Thenextweb

More articles in this cluster (26)

Following this threat?

Track Cloudflare and CVE-2012-1823 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (28)

1 / 3

Common questions

Which PHP versions are affected?
PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are patched; earlier versions require upgrades.
What should organizations do immediately?
Organizations must apply the emergency patches and verify that their PHP installations are updated.
Is there evidence of exploitation in the wild?
Yes, multiple reports confirm active exploitation attempts targeting the PHP2Shell vulnerabilities.