Skip to content
Critical PHP2Shell Vulnerabilities Prompt New Detection Tool Release

Critical PHP2Shell Vulnerabilities Prompt New Detection Tool Release

First seen 22 Oct 2026, 17:46 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 18:44 UTC
  • •CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities with a CVSS score of 9.2.
  • •Searchlight Cyber's scanner uses live probes to detect vulnerabilities, increasing accuracy but posing risks.
  • •PHP released patches for these vulnerabilities on October 21, 2026.

On October 21, 2026, PHP released patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. These vulnerabilities, known as php2shell, can be exploited by sending targeted requests that trigger a PHP memory exhaustion condition. Searchlight Cyber has developed a free, open-source scanner that tests hosts for these vulnerabilities using live probes, rather than relying solely on version checks. The scanner's method is more informative but carries a risk of disruption due to the nature of the checks. The vulnerabilities were disclosed publicly on October 21, 2026, with the first proof-of-concept (PoC) appearing the same day. Organizations using PHP are urged to assess their exposure and apply the patches released by PHP.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
PHP patches released for vulnerabilities
PHP issued patches for CVE-2026-109618 and CVE-2026-109619, both critical flaws affecting PHP installations.
Feeds.4Sysops
2026-10-21
First public PoC for CVE-2026-109619
The first proof-of-concept for CVE-2026-109619 was made public, demonstrating the vulnerability's exploitability.
Slcyber
2026-10-22
First public PoC for CVE-2026-109618
The first proof-of-concept for CVE-2026-109618 was released, highlighting the vulnerability's potential impact.
Slcyber

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 2

Common questions

What systems are affected by php2shell?
Any PHP installations that have not applied the patches for CVE-2026-109618 and CVE-2026-109619 are at risk.
How can I check if my system is vulnerable?
You can use Searchlight Cyber's free php2shell scanner, which tests hosts with live probes.
What should I do if my system is vulnerable?
Immediately apply the patches released by PHP to mitigate the vulnerabilities.