Skip to content
PHP Vulnerabilities PHP2Shell

PHP Vulnerabilities PHP2Shell

First seen 29 Oct 2026, 05:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 06:38 UTC
  • •CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities with CVSS 9.2.
  • •Active exploitation of these vulnerabilities has been confirmed since October 26, 2026.
  • •Affected PHP versions include all since 5.4.0; immediate patching is recommended.

Two vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, with a CVSS score of 9.2. These vulnerabilities affect all PHP versions since 5.4.0 and can be exploited before any application code runs, making them particularly severe. The vulnerabilities were added to the CISA KEV list on October 26, indicating in the wild. Tools like `php2shell-repro` have been developed to probe for these vulnerabilities without executing harmful code. The vulnerabilities can lead to remote code execution and memory corruption. Administrators are urged to verify their PHP versions and apply patches to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
Two critical vulnerabilities in PHP disclosed, affecting all versions since 5.4.0.
Sploitus
2026-10-25
First public PoC released
Public proof-of-concept code for PHP2Shell vulnerabilities made available.
Sploitus
2026-10-26
CISA adds vulnerabilities to KEV list
CISA confirmed active exploitation of CVE-2026-109618 and CVE-2026-109619.
Sploitus

More articles in this cluster (3)

Following this threat?

Track Debian and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 4

Common questions

Which PHP versions are vulnerable?
All PHP versions since 5.4.0 are affected by these vulnerabilities.
What is the current exploitation status?
Active exploitation of these vulnerabilities has been confirmed as of October 26, 2026.
What should I do to protect my systems?
Immediately update to the patched versions of PHP to mitigate these vulnerabilities.