TWO critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been named PHP2Shell. The PHP security team rated both 9.2 on CVSS v4.0, and researchers say they could allow remote code execution. The flaws were leaked on 20 October 2026, two days before their planned coordinated disclosure. PHP announced an emergency security release for 21 October at 14:00 UTC. At the time of the report, PHP had not published the technical details, scoring vectors or confirmed which versions are affected. Claims that every version from PHP 5 onwards is vulnerable remain unverified.
PHP plans fixes for supported branches 8.2, 8.3, 8.4 and 8.5; end-of-life branches, including 8.1, 8.0, 7.x and 5.x, will not receive updates. Because the fixes are in PHP itself, updating applications such as WordPress, Drupal or Magento alone will not address the issue. The report said there was no confirmed exploitation in the wild and neither CVE was in CISA’s Known Exploited Vulnerabilities catalogue.
Patchstack had claimed active incidents, but the article said those claims lacked published technical evidence. WatchTowr said it had reproduced CVE-2026-109618 but was withholding details until patches were released.
PHP had published no workaround. CERT-EU advised considering isolation of internet-facing applications until a fix is available. The article recommends identifying PHP installations, applying vendor or provider updates as soon as they are released, and monitoring for PHP processes launching shells, script interpreters or download tools. If suspicious activity is found, isolate the server, preserve logs and check for web shells, unexpected files, scheduled tasks and accounts.