Skip to content
Critical PHP2Shell Vulnerabilities Prompt Global Response

Critical PHP2Shell Vulnerabilities Prompt Global Response

First seen 30 Oct 2026, 21:45 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 30, 2026 at 23:16 UTC
  • •PHP2Shell vulnerabilities allow unauthenticated RCE, affecting 70% of websites.
  • •Active exploitation confirmed with attempts dating back to October 17, 2026.
  • •CISA added PHP2Shell CVEs to its KEV catalog, mandating federal agency remediation.

Two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were disclosed on October 21, 2026, with a CVSS score of 9.2. These flaws allow unauthenticated remote code execution (RCE) and affect approximately 70% of websites globally. The vulnerabilities were discovered by security firms Calif and Wiz and were leaked on October 20, leading to active exploitation attempts as early as October 17. Major platforms, including government and educational sites, have experienced operational impacts, prompting emergency downtime. CISA has added these CVEs to its Known Exploited Vulnerabilities catalog with a remediation deadline of October 29. The complexity of exploitation has limited mass automated attacks, but targeted compromises are ongoing. A related Linux kernel flaw, CVE-2026-46300, is also being exploited in conjunction with PHP2Shell vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-14
Public exploit for CVE-2026-46300 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-20
PHP2Shell vulnerabilities leaked
Details of CVE-2026-109618 and CVE-2026-109619 were leaked ahead of coordinated disclosure, leading to active exploitation attempts.
Praetorian
2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
The vulnerabilities were officially published with a CVSS score of 9.2, indicating critical severity.
Foregenix
2026-10-22
CVE-2026-111497 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-26
CISA adds PHP2Shell to KEV
CISA included both PHP2Shell CVEs in its Known Exploited Vulnerabilities catalog, confirming active exploitation.
Sentinelone
2026-10-29
Remediation deadline for federal agencies
CISA mandated federal agencies to remediate PHP2Shell vulnerabilities by this date.
Sentinelone

More articles in this cluster (3)

Following this threat?

Track Hive, eMudhra and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (39)

1 / 4

Common questions

Which systems are affected by PHP2Shell?
PHP2Shell vulnerabilities affect systems running PHP, including popular CMS platforms like WordPress, Magento, and Drupal.
What is the current status of exploitation?
Active exploitation of PHP2Shell vulnerabilities has been confirmed, with attempts reported as early as October 17, 2026.
What should organizations do to protect themselves?
Organizations should prioritize applying patches for PHP and monitor for any signs of exploitation, especially if using affected systems.