Skip to content
PHP2Shell Vulnerabilities Prompt Urgent Patching Amidst Mixed Reports

PHP2Shell Vulnerabilities Prompt Urgent Patching Amidst Mixed Reports

First seen 28 Oct 2026, 17:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 18:11 UTC
  • •PHP2Shell vulnerabilities affect PHP versions back to 5.4, impacting major platforms.
  • •Patches for CVE-2026-109618 and CVE-2026-109619 were released on October 21, 2026.
  • •Despite critical ratings, actual exploitation remains unconfirmed, with no reported compromises.

In late August 2026, Wiz Research discovered two remote code execution vulnerabilities in PHP, named PHP2Shell, affecting versions back to PHP 5.4. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were reported to the PHP team on August 24, with patches released on October 21. Despite the nature of these vulnerabilities, reports indicate that actual exploitation in the wild remains unconfirmed, with no vendor reporting successful compromises. The vulnerabilities impact a significant portion of the internet, including major platforms like WordPress and Drupal. Wiz's AI tools were instrumental in uncovering these long-standing flaws, which had evaded detection due to their complexity. As of October 26, both CVEs were added to the CISA KEV list for. Organizations are urged to update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2012-05-11
CVE-2012-1823 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2024-06-07
Public exploit for CVE-2024-4577 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-08-24
Vulnerabilities reported to PHP team
Wiz Research disclosed PHP2Shell vulnerabilities to the PHP team, prompting investigation.
O'Reilly
2026-10-17
PHP2Shell detected in the wild
Amazon reported detecting PHP2Shell vulnerabilities being exploited in the wild prior to public disclosure.
O'Reilly
2026-10-21
Patches released for vulnerabilities
The PHP team released updates addressing CVE-2026-109618 and CVE-2026-109619.
O'Reilly
2026-10-26
CVE-2026-109618 and CVE-2026-109619 added to CISA KEV
Both vulnerabilities were added to the CISA KEV list, indicating active exploitation concerns.
O'Reilly

More articles in this cluster (3)

Following this threat?

Track notpetya and CVE-2012-1823 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 2

Common questions

Which PHP versions are affected?
PHP versions from 5.4 to 8.5.12 are affected by the PHP2Shell vulnerabilities.
What should organizations do now?
Organizations should urgently update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to mitigate risks.
Is there confirmed exploitation of these vulnerabilities?
As of now, no confirmed exploitation has been reported, but the vulnerabilities have been added to the CISA KEV list.