Skip to content
Critical PHP2Shell Vulnerabilities Expose Millions to Remote Code Execution

Critical PHP2Shell Vulnerabilities Expose Millions to Remote Code Execution

First seen 21 Oct 2026, 20:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 07:39 UTC

On October 21, 2026, the PHP project released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These flaws allow unauthenticated attackers to execute arbitrary code on PHP servers, affecting versions from 5.4 to 8.5. The vulnerabilities stem from memory management issues during out-of-memory conditions and improper handling of request states. Attack attempts were observed shortly before the patches were released, indicating active exploitation in the wild. Organizations are urged to update PHP immediately, as configuration changes cannot fully mitigate the risks. The vulnerabilities carry a CVSS score of 9.2, highlighting their severity and potential impact on approximately 70% of the internet's web applications.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2019-10-28
CVE-2019-11043 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2024-06-09
CVE-2024-4577 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-04-22
CVE-2026-31431 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-06-16
CVE-2026-46331 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-15
CVE-2026-99999 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-20
Vulnerability details leaked
Details about CVE-2026-109618 and CVE-2026-109619 began circulating online, prompting urgent action.
Thenextweb
2026-10-21
Emergency patches released
PHP released patches for vulnerabilities CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2.
Precursorsecurity
2026-10-21
Active exploitation observed
Reports confirmed that exploitation attempts began shortly before the patch release.
Reliaquest
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (100)

Following this threat?

Track Debian and CVE-2019-11043 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (50)

1 / 4

Common questions

Which PHP versions are affected?
All PHP versions from 5.4 to 8.5.11 are vulnerable; only 8.2.35, 8.3.36, 8.4.27, and 8.5.12 have patches.
How urgent is the patching process?
Patching is urgent due to active exploitation attempts reported before the patches were released.
What should organizations do immediately?
Organizations should inventory all PHP installations and apply the latest patches immediately.