Sploitus

PHP Vulnerabilities Exploited via php2shell Tool

First seen 25 Oct 2026, 12:42 UTC • •69.8

Article Content

1 / 5

Browse articles

ThreatCluster •October 25, 2026 at 15:14 UTC

•CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities with CVSS 9.2.
•The php2shell tool can exploit these vulnerabilities across PHP versions 5.4 to 8.5.
•A Docker lab is available for testing vulnerable PHP setups.

A vulnerability in PHP, identified as CVE-2026-109618 and CVE-2026-109619, has been reported with a CVSS score of 9.2. The php2shell tool, which is designed for testing PHP applications, can exploit these vulnerabilities across PHP versions 5.4 to 8.5. The vulnerabilities stem from an use-after-free condition in the session.upload_progress feature, allowing attackers to execute commands on vulnerable systems. The php2shell tool includes a Docker lab for testing and can differentiate between vulnerable and patched PHP builds. The first public proof-of-concept (PoC) was released on October 21, 2026, with further research published on October 23. Security professionals are advised to upgrade their PHP installations to mitigate risks. The vulnerabilities are, and exploitation in the wild has not been confirmed yet.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-21

CVE-2026-109619 published

CVE-2026-109619 was published with a CVSS score of 9.2, marking the first public PoC release.

2026-10-21

CVE-2026-109618 published

CVE-2026-109618 was published with a CVSS score of 9.2, detailing a use-after-free vulnerability.

2026-10-23

First PoC for CVE-2026-109618 released

The first public PoC for CVE-2026-109618 was released, demonstrating the exploit capabilities.

2026-10-25

php2shell tool released

The php2shell tool was released, designed to assess PHP endpoints and identify vulnerabilities.

More articles in this cluster (4)

Threat Graph

20 entities, 57 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Zero-day Exploit
T1059 - Command and Scripting Interpreter

Campaign (1)

Apache Campaign

Vulnerability (4)

CVE-2026-109618
CVE-2026-109619
RCE Via OOM Corruption
RCE Via Stale Global State

Weakness (1)

CWE-416 - Use After Free

Affected Platform (4)

Apache
Linux
PHP
WordPress

Tool (7)

Docker
Nginx
Assetnote Scanner
Nuclei
PHP2Shell
ProjectDiscovery
SIGiL

Relationships

Docker exploits CVE-2026-109618
Docker exploits CVE-2026-109619
Docker exploits RCE Via OOM Corruption
Docker exploits RCE Via Stale Global State
Nginx exploits CVE-2026-109618
Nginx exploits CVE-2026-109619
Nginx exploits RCE Via OOM Corruption
Nginx exploits RCE Via Stale Global State
Assetnote Scanner exploits CVE-2026-109618
Assetnote Scanner exploits CVE-2026-109619
Assetnote Scanner exploits RCE Via OOM Corruption
Assetnote Scanner exploits RCE Via Stale Global State
Nuclei exploits CVE-2026-109618
Nuclei exploits CVE-2026-109619
Nuclei exploits RCE Via OOM Corruption
Nuclei exploits RCE Via Stale Global State
PHP2Shell exploits CVE-2026-109618
PHP2Shell exploits CVE-2026-109619
PHP2Shell exploits RCE Via OOM Corruption
PHP2Shell exploits RCE Via Stale Global State
ProjectDiscovery exploits CVE-2026-109618
ProjectDiscovery exploits CVE-2026-109619
ProjectDiscovery exploits RCE Via OOM Corruption
ProjectDiscovery exploits RCE Via Stale Global State
SIGiL exploits CVE-2026-109618
SIGiL exploits CVE-2026-109619
SIGiL exploits RCE Via OOM Corruption
SIGiL exploits RCE Via Stale Global State
CVE-2026-109618 targets Apache
CVE-2026-109618 targets Linux
CVE-2026-109618 targets PHP
CVE-2026-109618 targets WordPress
CVE-2026-109619 targets Apache
CVE-2026-109619 targets Linux
CVE-2026-109619 targets PHP
CVE-2026-109619 targets WordPress
RCE Via OOM Corruption targets Apache
RCE Via OOM Corruption targets Linux
RCE Via OOM Corruption targets PHP
RCE Via OOM Corruption targets WordPress
RCE Via Stale Global State targets Apache
RCE Via Stale Global State targets Linux
RCE Via Stale Global State targets PHP
RCE Via Stale Global State targets WordPress
Malware targets Apache
Malware targets Linux
Malware targets PHP
Malware targets WordPress
Zero-day Exploit targets Apache
Zero-day Exploit targets Linux
Zero-day Exploit targets PHP
Zero-day Exploit targets WordPress
T1059 - Command and Scripting Interpreter targets Apache
T1059 - Command and Scripting Interpreter targets Linux
T1059 - Command and Scripting Interpreter targets PHP
T1059 - Command and Scripting Interpreter targets WordPress
Apache Campaign related to CWE-416 - Use After Free

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which PHP versions are affected?

The vulnerabilities affect PHP versions from 5.4 to 8.5.

Is there a PoC available?

Yes, public proof-of-concept code for CVE-2026-109618 and CVE-2026-109619 is available.

What should I do to protect my systems?

Upgrade your PHP installations to the latest supported versions to mitigate these vulnerabilities.

Continue Reading

Lazarus Group Linked to PHP Vulnerability Exploitation Plans A cybersecurity report from Cyfirma indicates that a group suspected to be linked to North Korea's Lazarus Group is preparing to exploit critical vulnerabilities in PHP, specifically CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. The attackers, communicating in Korean, are…

Japan Issues Warning Over Critical PHP Vulnerabilities Affecting Government Sites Japanese Prime Minister Sanae Takaichi announced critical vulnerabilities in the PHP programming language, widely used on government and commercial websites. The vulnerabilities, CVE-2026-109619 and CVE-2026-109618, both rated CVSS 9.2, were disclosed on October 21, 2026, with proof-of-concept code for CVE-2026-109618…