Skip to content
PHP2Shell Vulnerabilities Exploited, Patching Efforts Lag

PHP2Shell Vulnerabilities Exploited, Patching Efforts Lag

First seen 27 Oct 2026, 23:46 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 00:46 UTC
  • •CVE-2026-109618 and CVE-2026-109619 have a CVSS score of 9.2, indicating critical vulnerabilities.
  • •Only 19% of exposed PHP hosts globally have been patched as of October 26, 2026.
  • •Active exploitation of PHP2Shell vulnerabilities has been confirmed, emphasizing the need for urgent remediation.

The PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, published on October 21, 2026, have a CVSS score of 9.2, indicating critical severity. As of October 26, 2026, only 19% of exposed hosts globally have been patched, with significant disparities across regions. The EU shows better patching rates, with 50% in the Netherlands and around 40% in DACH countries, while the UK and US lag behind at 25% and 20%, respectively. Reports confirm that these vulnerabilities are being, with evidence of remote code execution observed in honeypots. Security experts warn that the gap between vulnerability disclosure and exploitation is shrinking, increasing the urgency for organizations to patch their systems. The current status indicates that many systems remain vulnerable, with millions still running unsupported PHP versions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
Two critical PHP vulnerabilities were disclosed, with a CVSS score of 9.2.
Thenewstack
2026-10-24
First public PoC released
Proof-of-concept code for the PHP2Shell vulnerabilities was made publicly available.
Thenewstack
2026-10-26
CISA adds CVEs to KEV list
CVE-2026-109618 and CVE-2026-109619 were added to the CISA Known Exploited Vulnerabilities catalog.
Computerweekly
2026-10-26
Active exploitation confirmed
Successful exploitation of PHP2Shell vulnerabilities was observed in honeypots, indicating real-world compromises.
Computerweekly

More articles in this cluster (3)

Following this threat?

Track Lazarus Group and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (21)

1 / 3

Common questions

Which PHP versions are affected?
The vulnerabilities affect PHP versions that are publicly accessible and may include unsupported versions.
What is the current patching status?
As of October 26, 2026, only 19% of exposed PHP hosts globally have been patched.
How urgent is the need to patch?
The urgency is high due to confirmed active exploitation of the vulnerabilities in the wild.