Skip to content
Critical PHP2Shell Vulnerabilities Expose Servers to Remote Code Execution

Critical PHP2Shell Vulnerabilities Expose Servers to Remote Code Execution

First seen 22 Oct 2026, 18:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 19:44 UTC
  • •Two critical vulnerabilities in PHP allow remote code execution without authentication.
  • •Affected systems include popular CMS platforms like WordPress and Joomla.
  • •Patches were released for PHP versions 8.2 to 8.5 on October 21, 2026.

On October 21, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed, collectively named PHP2Shell, affecting standard PHP servers with an active upload tracker. These flaws allow unauthenticated remote code execution, impacting widely used applications like WordPress, Drupal, and Joomla. The vulnerabilities arise from improper memory management during error handling, leading to use-after-free conditions. Security teams are currently assessing the impact and developing detection tools, while public proof-of-concept code has emerged. PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been released to address these issues, but no solutions were available at the time of the advisory. Administrators are urged to verify their server configurations and apply patches promptly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
PHP disclosed two critical vulnerabilities allowing pre-authentication remote code execution.
Psirt.Watchguard
2026-10-21
PHP patches released
PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were released to address the vulnerabilities.
Psirt.Watchguard
2026-10-22
Public PoC for CVE-2026-109618 released
The first public proof-of-concept for CVE-2026-109618 was made available, increasing urgency for patching.
Cristinaiglesias

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 4

Common questions

Which PHP versions are affected?
PHP versions 8.2 to 8.5 are affected by the vulnerabilities.
Is there a patch available?
Yes, patches were released for PHP versions 8.2 to 8.5 on October 21, 2026.
What should I do if I'm using an affected version?
Administrators should apply the latest PHP updates immediately to mitigate the vulnerabilities.