Skip to content
PHP Vulnerabilities Threaten 70% of Websites

PHP Vulnerabilities Threaten 70% of Websites

First seen 31 Oct 2026, 02:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 31, 2026 at 03:14 UTC
  • •PHP vulnerabilities affect around 70% of websites globally.
  • •Two critical CVEs (CVE-2026-109618, CVE-2026-109619) were published on October 21, 2026.
  • •Patches have been released, but many users may still be at risk if not updated.

A security researcher has discovered vulnerabilities in PHP, affecting approximately 70% of websites globally. The flaws, known as PHP2Shell, consist of two CVEs (CVE-2026-109618 and CVE-2026-109619), both published on October 21, 2026, with a CVSS score of 9.2, indicating a severity level. These vulnerabilities allow attackers to exploit PHP-powered websites, potentially gaining unauthorized access to user credentials and launching further attacks. The PHP organization has released patches, but many users, especially those running WordPress, may remain vulnerable if they do not update their systems. The vulnerabilities were added to the CISA KEV list for on October 26, 2026. Cybersecurity experts are urging immediate action to mitigate risks associated with these flaws.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
PHP vulnerabilities disclosed
Security researchers published findings on two critical vulnerabilities in PHP, known as PHP2Shell.
Miamioh.Edu
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-26
CISA adds vulnerabilities to KEV list
CVE-2026-109618 and CVE-2026-109619 were added to the CISA KEV list for active exploitation.
Kpbs
2026-10-30
Patches released
The PHP organization released patches to address the vulnerabilities, urging users to update their systems.
Kpbs

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 2

Common questions

What are the specific CVEs?
The vulnerabilities are CVE-2026-109618 and CVE-2026-109619, both critical with a CVSS score of 9.2.
How widespread is the impact?
Approximately 70% of websites globally are powered by PHP, making them potentially vulnerable.
What should website owners do?
Website owners should apply the patches released by the PHP organization immediately to mitigate risks.