Skip to content
Critical PHP2Shell Vulnerabilities Expose Web Servers to RCE

Critical PHP2Shell Vulnerabilities Expose Web Servers to RCE

First seen 22 Oct 2026, 15:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 03:14 UTC
  • •CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE in PHP.
  • •Emergency patches were released on October 21, 2026, after early exploitation attempts were reported.
  • •All PHP installations serving web requests are at risk, including popular platforms like WordPress and Drupal.

On October 21, 2026, PHP disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively termed PHP2Shell, which allow unauthenticated remote code execution (RCE) through improper memory handling during request processing. Both vulnerabilities received a CVSS score of 9.2, indicating their critical nature. Exploitation can occur via specially crafted HTTP requests, affecting all PHP installations serving web requests, including Apache with mod_php, PHP-FPM, and others. Emergency patches were released on the same day, and reports indicate that exploitation attempts began shortly before the disclosure, raising concerns about in the wild. Security teams are urged to update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to mitigate the risks. Tools and scripts for detecting and exploiting these vulnerabilities have already begun circulating online, prompting immediate action from system administrators.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2015-06-09
CVE-2015-4024 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2019-09-24
Public exploit for CVE-2019-11043 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2024-06-07
Public exploit for CVE-2024-4577 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2025-07-17
CVE-2025-54068 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-20
Exploitation attempts reported
Security researchers observed exploitation attempts targeting the vulnerabilities before their public disclosure.
Heise
2026-10-21
CVE-2026-109618 and CVE-2026-109619 disclosed
PHP announced two critical vulnerabilities allowing RCE, with patches released the same day.
Acronis
2026-10-21
Emergency patches released
PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address the vulnerabilities.
Techradar

More articles in this cluster (55)

Following this threat?

Track Debian and CVE-2012-1823 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (50)

1 / 4

Common questions

Which PHP versions are affected?
All PHP versions serving web requests, including Apache with mod_php and PHP-FPM, are affected.
Is there evidence of active exploitation?
Yes, security researchers reported exploitation attempts before the vulnerabilities were disclosed.
What should I do to protect my systems?
Immediately update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to mitigate the vulnerabilities.