Skip to content
Critical PHP2Shell Vulnerabilities Threaten Church Websites

Critical PHP2Shell Vulnerabilities Threaten Church Websites

First seen 28 Oct 2026, 15:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 16:11 UTC
  • •Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow remote code execution.
  • •Active exploitation of these vulnerabilities has been confirmed, affecting PHP-based websites.
  • •Emergency patches were released on October 21, 2026; immediate action is required from affected organizations.

Two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, with a CVSS score of 9.2. These vulnerabilities allow unauthenticated attackers to execute remote code on affected websites, posing significant risks to church websites that rely on PHP-based platforms like WordPress. The General Council on Finance and Administration (GCFA) has urged immediate action from congregations, as these vulnerabilities are actively exploited. The PHP development team released emergency patches for the affected versions, but many organizations may still be vulnerable if they are using outdated PHP versions. Website owners are advised to verify their PHP versions and apply the necessary patches promptly to mitigate risks. Failure to do so could lead to unauthorized access, defacement, or data exposure.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
PHP2Shell vulnerabilities disclosed
Two critical vulnerabilities in PHP were published, allowing remote code execution on affected systems.
Webdisclosure
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-24
First public PoC released
Proof-of-concept code for CVE-2026-109619 was made publicly available, increasing the risk of exploitation.
Webdisclosure
2026-10-26
CVE added to CISA KEV
CVE-2026-109618 and CVE-2026-109619 were added to the CISA Known Exploited Vulnerabilities catalog due to active exploitation.
Umcna

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 2

Common questions

Which PHP versions are affected?
PHP versions prior to the patched releases (8.2.35, 8.3.36, 8.4.27, 8.5.12) are vulnerable.
How urgent is the situation?
The vulnerabilities are actively exploited, and immediate patching is recommended to prevent unauthorized access.
What should I do if my site is managed by a third party?
Contact your hosting provider or web administrator to confirm they have applied the necessary patches.