Skip to content
Critical PHP2Shell Vulnerabilities Threaten Websites Worldwide

Critical PHP2Shell Vulnerabilities Threaten Websites Worldwide

First seen 28 Oct 2026, 16:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 16:39 UTC
  • •Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) allow remote code execution.
  • •Emergency patches were released on October 21, 2026, but many systems remain vulnerable.
  • •Active exploitation has been confirmed, with attacks targeting various PHP-dependent websites.

On October 21, 2026, PHP disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 on the CVSS scale. These flaws allow unauthenticated remote code execution, potentially enabling attackers to take control of affected servers without a password. Organizations using PHP, particularly those relying on platforms like WordPress, Drupal, and Joomla, are at risk. The vulnerabilities have been actively exploited since their disclosure, with reports of attacks targeting church websites and other PHP-dependent services. Emergency patches were released on the same day as the disclosure, but many organizations may still be vulnerable if they are using outdated PHP versions. The urgency for organizations to assess their PHP installations and apply the necessary patches is critical, especially for those with public-facing services. CISA added these vulnerabilities to its KEV catalog on October 26, indicating in the wild.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-13
CVE-2026-96951 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
PHP vulnerabilities disclosed
PHP announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing remote code execution.
Specialistrisk
2026-10-21
Emergency patches released
PHP released security updates for affected versions to address the vulnerabilities.
Umcna
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-24
Public exploit for CVE-2026-115560 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-26
CISA adds vulnerabilities to KEV
CISA included CVE-2026-109618 and CVE-2026-109619 in its Known Exploited Vulnerabilities catalog.
Specialistrisk

More articles in this cluster (4)

Following this threat?

Track LiteSpeed and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (21)

1 / 4

Common questions

What versions of PHP are affected?
PHP versions that are not updated to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 are at risk.
How urgent is the patching process?
Patching is urgent due to confirmed active exploitation of the vulnerabilities in the wild.
What should organizations do immediately?
Organizations should identify their PHP versions, apply the patches, and consider taking vulnerable sites offline if they cannot be patched quickly.