CVE-2026-109619
published 2026-10-21CVE-2026-109619: PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated…
PriorityP191high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-10-29
Exploited in the wild
EPSS
100.00%
100.0th percentile
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Affected
321 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | udi-rhel9 | — | — |
| paloalto | bridgecrew | — | — |
| paloalto | cloud_ngfw | — | — |
| paloalto | cortex_xdr_agent | — | — |
| paloalto | cortex_xpanse | — | — |
| paloalto | cortex_xsiam | — | — |
| paloalto | cortex_xsoar | — | — |
| paloalto | globalprotect_app | — | — |
| paloalto | idira | — | — |
| paloalto | pan-os | — | — |
| paloalto | panorama | — | — |
| paloalto | prisma_access | — | — |
| paloalto | prisma_access_agent | — | — |
| paloalto | prisma_cloud | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_redhat8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-10-21·CVSS 9.8
CVE-2026-109618 [CRITICAL] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: PHP could be made to crash or run programs if it received specially crafted
network traffic.
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,
Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates
in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04
LTS.
Original advisory details:
It was discovered that PHP incorrectly handled out-of-memory conditions
while processing requests. A remote attacker could use this issue to
execute arbitrary code. (CVE-2026-109618)
It was discovered that PHP incorrectly managed internal request state
across worker reuse. A remote attacker could use this issue to execute
arbitrary code. (CVE-2026-109619)
Instructions: In general, a standard system update will
Red Hat
php: fatal error handling retains stale request state leading to use-after-free
vendor_redhat·2026-10-21·CVSS 8.1
CVE-2026-109619 [HIGH] CWE-416 php: fatal error handling retains stale request state leading to use-after-free
php: fatal error handling retains stale request state leading to use-after-free
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-10-21·CVSS 9.8
CVE-2026-109618 [CRITICAL] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: PHP could be made to crash or run programs if it received specially
crafted network traffic.
It was discovered that PHP incorrectly handled out-of-memory conditions
while processing requests. A remote attacker could use this issue to
execute arbitrary code. (CVE-2026-109618)
It was discovered that PHP incorrectly managed internal request state
across worker reuse. A remote attacker could use this issue to execute
arbitrary code. (CVE-2026-109619)
Instructions: In general, a standard system update will make all the necessary changes.
Fortinet
PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
vendor_fortinet·CVSS 9.8
CVE-2026-109618 [CRITICAL] PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
FG-IR-26-186: PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
CVSSv3 Score:
9.8
CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Revised on 2026-10-21 00:00:00
Palo Alto
Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products
vendor_paloalto·CVSS 9.8
CVE-2026-109618 [CRITICAL] CWE-754 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products
Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products
Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.
CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.
CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.
Palo Alto Networks has conducted an e
VulnCheck
PHP PHP Use After Free
vulncheck·2026·CVSS 9.8
CVE-2026-109619 [CRITICAL] PHP PHP Use After Free
PHP PHP Use After Free
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Affected: PHP PHP
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-109619&date=2026-10-21; https://aws.amazon.com/blogs/security/amazon-thre
Nuclei
PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Vulnerable Version Detection
nuclei·CVSS 9.8
CVE-2026-109618 [CRITICAL] PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Vulnerable Version Detection
PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Vulnerable Version Detection
Detects upstream PHP versions affected by the PHP2Shell vulnerabilities using
the exact version disclosed in the X-Powered-By response header. This is a
passive version check and does not attempt exploitation or validate runtime
configuration. Vendor packages may contain backported fixes without changing
the upstream PHP version string.
Template:
id: CVE-2026-109618
info:
name: PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Vulnerable Version Detection
author: princechaddha
severity: critical
description: |
Detects upstream PHP versions affected by the PHP2Shell vulnerabilities using
the exact version disclosed in the X-Powered-By response header. This is a
passive version check and does not attempt exploitation
Hackernews
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
blogs_hackernews·2026-10-26
CVE-2026-48356 Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025.
According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages that, when visited by unsuspecting users, serves malicious JavaScript loader code through Magento CMS blocks.
"When you visit, that code makes your browser ask the group's server what to do next," Sansec said . "The server first checks whether you are a real shopper or a
Hackernews
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
blogs_hackernews·2026-10-26·CVSS 9.8
CVE-2026-109618 [CRITICAL] ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with.
And that's not even the full story. A leaked key led to a software supply-chain attack. AI agents are being tricked into following harmful instructions. Old bugs are still being used to break into systems, and some att
Checkpoint
26th October – Threat Intelligence Report
blogs_checkpoint·2026-10-26
CVE-2026-109618 26th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 26th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a cyberattack in which intruders compromised its infrastructure and installed malware on customer servers. More than 26,000 servers were potentially affected. The provider began shutting down customer environments on October 21 to contain the intrusion and prevent further un
Tenable
Discover and remediate PHP2Shell exposure with Tenable
blogs_tenable·2026-10-26·CVSS 9.8
CVE-2026-109618 [CRITICAL] Discover and remediate PHP2Shell exposure with Tenable
## Discover and remediate PHP2Shell exposure with Tenable
Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster.
## Key takeaways
The PHP2Shell vulnerabilities ( CVE-2026-109618 and CVE-2026-109619 ) put security teams in a race against attackers. PHP runs on more than 70% of websites, so organizations need to quickly find where they’re affected and update PHP to fixed versions.
Tenable helps you find PHP2Shell across your attack surface. Tenable One Attack Surface Management discovers externally facing PHP assets. Tenable One Vulnerability Management and Tenable Security Center provide detections, including local checks for Linux distribution packages. Te
Hackernews
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
blogs_hackernews·2026-10-25·CVSS 9.8
CVE-2026-109618 [CRITICAL] PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
"In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets," Palo Alto Networks Unit 42 said .
"They also established an NT LAN Manager (NTLM)-relay tunnel into Active D
Hackernews
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
blogs_hackernews·2026-10-23·CVSS 9.8
CVE-2026-109618 [CRITICAL] PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium , as it emerges that weaponizing the flaws may be harder than previously thought.
The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
"However
Hackernews
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
blogs_hackernews·2026-10-23·CVSS 9.8
CVE-2026-115560 [CRITICAL] PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws.
The new issue, assigned CVE-2026-115560 , affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.
The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called session upload progress until a fix is available in the next routine release.
The warning came in a short informational advisory published on October 23
Tenable
The adversary economy: How threat actors are reacting to PHP2Shell
blogs_tenable·2026-10-22·CVSS 9.8
CVE-2026-109618 [CRITICAL] The adversary economy: How threat actors are reacting to PHP2Shell
## The adversary economy: How threat actors are reacting to PHP2Shell
Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target.
## Key takeaways
The adversary economy operates on the same fundamental principles as the legitimate economy.
Forum self-evacuations: Criminal forums including BreachForums initiated emergency infrastructure migrations, taking themselves offline within hours of PHP2Shell disclosure, citing direct risk to their operations.
Underground operators face a dual threat: both law enforcement and rival criminal groups could weaponize PHP2Shell against forum infrastructure storing member identities, private com
Hackernews
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
blogs_hackernews·2026-10-22·CVSS 9.8
CVE-2026-109618 [CRITICAL] Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities dating back to October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches.
"The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses, CISO of Amazon Integrated Security, said in a post shared with The Hacker News.
"While the vulnerability was under embargo, the t
Schneier
New Serious PHP Vulnerabilities Released and Patched
blogs_schneier·2026-10-22·CVSS 8.1
CVE-2026-109619 [HIGH] New Serious PHP Vulnerabilities Released and Patched
## New Serious PHP Vulnerabilities Released and Patched
PHP maintainers have released fixes for two critical vulnerabilities:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
The vulnerabilities:
RCE via stale global state, CVE-2026-109619 ( GHSA-6wmf-4rv5-p3rp ): request-owned internal state can survive after its backing memory has been freed. A later request
Krebs
Widespread PHP Flaw May Cause Many Site Outages Today
blogs_krebs·2026-10-21
CVE-2026-109618 Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild.
Image: Shutterstock.com, Sashkin.
The flaws at issue are present in PHP , the programming language that powers sites running on a large number of web publishing systems, including Drupal , Magento , Joomla and WordPress . Earlier today, PHP released an emergency security update to fix two critical bugs that can allow an attacker to execute code of their choosing on a vulnerable server.
Reuters reports that government websites in Europe and e
Hackernews
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
blogs_hackernews·2026-10-21
CVE-2026-109618 PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory.
PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described.
⚡ UPDATE — PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
Security researchers at watchTowr say t
Unit42
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
blogs_unit42·2026-10-21
CVE-2026-109618 Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
## Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
Unit 42
Published: October 21, 2026
High Profile Threats
Vulnerabilities
CVE-2026-109618
CVE-2026-109619
## Executive Summary
Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). We encourage reviewing the PHP Group’s security advisory and patching guidance .
PHP is widely used across web servers and content management systems globally. We recommend assessing your exposure to these vulnerabilities and patching immediately.
Unit 42 has seen proof of concept of these vulnerabilities. At least one European government has taken its website offline as a precaution.
Palo Alto Network
Hackernews
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
blogs_hackernews·2026-10-21
CVE-2026-10795 Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.
TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote management service that's used for managing multiple sites remotely. A client component of UpdraftCentral is shipped within every copy of UpdraftPlus.
"Over the we
Tenable
php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
blogs_tenable·2026-10-21
CVE-2026-109618 php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
## php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
PHP has released patches for two critical remote code execution vulnerabilities. Fixes are available for PHP 8.2 through 8.5, with source backports for end-of-life PHP 7.4 through 8.1.
## Change log
Update October 21: PHP released patches and published its advisories. This post now includes vulnerability details, fixed versions, source backports for end-of-life branches, interim mitigation guidance, updated exploitation details and Tenable product coverage and Vulnerability Watch classification.
Update October 21: PHP released patches and published its advisories. This post now includes vulnerability details, fixed versions, source backports for end-of-li
Recorded Future
PHP2Shell Exploitation: Two Critical PHP Flaws Explained
blogs_recorded_future·2026-10-21
CVE-2026-109618 PHP2Shell Exploitation: Two Critical PHP Flaws Explained
## PHP2Shell Exploitation: Two Critical PHP Flaws Explained
Two critical remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (nicknamed “PHP2Shell”), are reportedly being targeted in active exploitation attempts following the leak of technical details ahead of PHP’s October 21, 2026, security release. Because the flaws affect PHP itself rather than a specific application, websites running vulnerable PHP versions may be exposed, including those built on WordPress, Drupal, and Joomla.
This post covers PHP’s advisories, exploitation reports, public proof-of-concept exploits, exposure data, and patching guidance, along with details from the TTP Instance Insikt Group® published to customers. Attack Surface Intelligence signatures for CVE-2026-109618 an
Hackernews
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
blogs_hackernews·2026-10-21
CVE-2026-109618 PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server.
The flaws, together called PHP2Shell , sit in the PHP runtime, not in any application, so a site is exposed even when its own code is secure. The risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code r
Wiz
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
blogs_wiz·2026-10-21
CVE-2026-109618 PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
## Executive Summary
Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.
PHP is a backbone of the web: it’s the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others.
These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it , putting every affected website in immediate risk.
Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5
Sans Isc
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
blogs_sans_isc·2026-10-21
CVE-2026-109618 Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow]
Published: 2026-10-21. Last Updated: 2026-10-21 21:02:43 UTC
by Johannes Ullrich (Version: 1)
2 comment(s)
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.
Various vendors have released bulletins listing products that must be patched for this vulnerability. For example:
Cisco https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq
OPNSense https://x.com/opnsense/status/2112985458514756087
PFSense https://forum.netgate.com/topic/201565/critica
Qualys
PHP2Shell: PHP Patches Two Critical RCE Vulnerabilities, Urges Immediate Updates
blogs_qualys·2026-10-21
CVE-2026-109618 PHP2Shell: PHP Patches Two Critical RCE Vulnerabilities, Urges Immediate Updates
## Table of Contents
What the Vulnerabilities Affect
Fixed Versions and Upgrade Guidance
What Qualys Customers Can Do
Qualys Mitigation available for CVE-2026-109618 and CVE-2026-109619
Find vulnerable PHP installations beyond standard locations with Qualys Deep Scan
Detect Exposure the Moment Distributions Release Their Patches
Temporary Mitigations Recommended by PHP
Confirm That Remediation Is Complete
Updated: October 21, 2026
PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. Apache mod_php deployments warrant immediate attention: PHP reports a demonstrated exploit that can trigger before application code runs.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2.
Talos
Two critical RCEs in PHP core
blogs_talos·2026-10-21
CVE-2026-109618 Two critical RCEs in PHP core
## Two critical RCEs in PHP core
Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial intelligence and associated technologies played a key role in the discovery of these vulnerabilities — yet another example of how these technologies are forcing change across the landscape, most notably on patching processes for organizations because of the wave of vulnerabilities being disclosed.
Cisco customers are covered with the Cisco Talos Network Intrusion Prevention (SNORT®) signatures 67359 and 67360. These rules are also available in the Co
Securelist
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
blogs_securelist·2026-10-21
CVE-2026-109618 Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
## Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
posted 21 Oct 2026
minute read
Table of Contents
Vulnerability overview
Detection by Kaspersky solutions
## Vulnerability overview
On October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities (both rated 9.2 on the CVSS scale). The patches were released on Wednesday, October 21, 2026, at 14:00 UTC.
The release was expedited after information about the vulnerabilities was leaked to the public before the scheduled embargo was lifted. In a post on Hacker News, a user reported two RCE vulnerabilities in PHP, allegedly affecting all versions starting with PHP 5.4.0.
The vulnerabilities in question are CVE-2026-109618
Crowdstrike
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
blogs_crowdstrike
CVE-2026-109618 CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
## CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
## Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP.
October 21, 2026
Crowdstrike
Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation
blogs_crowdstrike
CVE-2026-109618 Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation
Why Organizations Secure AI Agents with Falcon Guardian Oct 23, 2026
Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation Oct 23, 2026
CrowdStrike Uncovers New Agentic AI Campaigns Oct 21, 2026
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell Oct 21, 2026
Why Organizations Secure AI Agents with Falcon Guardian Oct 23, 2026
Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation Oct 23, 2026
CrowdStrike Uncovers New Agentic AI Campaigns Oct 21, 2026
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell Oct 21, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO] Feb 21, 2019
A
NCSC
Critical security issue affecting PHP
ncsc·2026-10-21·CVSS 9.8
CVE-2026-109618 [CRITICAL] Critical security issue affecting PHP
News Download & print article PDF Download & print article PDF
## Critical security issue affecting PHP
The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
## What has happened?
PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.
PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user's browser. PHP is also used in a range of other products.
The security issue could allow a
Bugzilla
TODAY: Upcoming Critical PHP Security Release
bugzilla·2026-10-21·CVSS 9.8
CVE-2026-109618 [CRITICAL] TODAY: Upcoming Critical PHP Security Release
TODAY: Upcoming Critical PHP Security Release
The PHP security team would like to give advance notice of an upcoming security release.
It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.
It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.
All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.
We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
Full details, affected versions, and the fixed versions will be published with the release.
Thank you for helping us keep PHP secure.
08 Oct 2026
The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The repor
Bugzilla
CVE-2026-109619 php: fatal error handling retains stale request state leading to use-after-free
bugzilla·2026-10-16·CVSS 9.8
CVE-2026-109619 [CRITICAL] CVE-2026-109619 php: fatal error handling retains stale request state leading to use-after-free
CVE-2026-109619 php: fatal error handling retains stale request state leading to use-after-free
GHSA - https://github.com/php/php-src/security/advisories/GHSA-h37m-fxqh-w76h
Found a crash while investigating https://github.com/php/php-src/security/advisories/GHSA-626f-5vcj-8h2p.
An OOM at the wrong time can leave zend_array s in a corrupted
state, and cause a zval_ptr_dtor() on uninitialized memory during shutdown.
This seems critical as this can be triggered during input parsing.
Details
_zend_hash_str_add_or_update_i() updates ht->nNumUsed before initializing the bucket,
and then allocates a zend_string for the key with zend_string_init() . If
zend_string_init() OOMs, the zend_array is left with one uninitialized bucket.
idx = ht->nNumUsed++;
ht->nNumOfElements++;
p = ht->arData +
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rphttp://www.openwall.com/lists/oss-security/2026/10/21/16http://www.openwall.com/lists/oss-security/2026/10/21/17http://www.openwall.com/lists/oss-security/2026/10/21/23http://www.openwall.com/lists/oss-security/2026/10/21/7http://www.openwall.com/lists/oss-security/2026/10/22/14http://www.openwall.com/lists/oss-security/2026/10/22/15http://www.openwall.com/lists/oss-security/2026/10/22/16http://www.openwall.com/lists/oss-security/2026/10/22/19http://www.openwall.com/lists/oss-security/2026/10/22/2http://www.openwall.com/lists/oss-security/2026/10/22/20http://www.openwall.com/lists/oss-security/2026/10/23/4https://cert-portal.siemens.com/productcert/html/ssa-566512.htmlhttps://www.wiz.io/blog/php2shell-php-rce
2026-10-21
Published
2026-10-26
Added to CISA KEV
Exploited in the wild