PHP Patches Two Critical PHP2Shell Vulnerabilities After Reports of Exploitation Attempts
Summary
PHP fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026. Exploitation attempts were reported, but successful compromises remain unconfirmed; organizations should patch and investigate exposure.
Key points
- The flaws can enable unauthenticated remote code execution and memory disclosure through PHP memory-safety issues.
- PHP released fixes in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12; older unsupported branches are not covered by these fixes.
- Patchstack and Cloudflare reported early exploitation activity, but available evidence does not establish the extent of successful compromise.
- Public repositories claim to contain proof-of-concept exploits, but some rely on an invalidated exploitation theory and their effectiveness varies.
- Internet scans identified millions of PHP-running IP addresses; the scans do not confirm which hosts are vulnerable, and many version-disclosing servers ran end-of-life branches.
- Recommended actions include patching, inventorying exposed PHP deployments, applying temporary access controls where needed, and reviewing telemetry for activity dating back to October 20.
Article Details
- Vulnerability Types
- Use-after-free
- Memory disclosure
- Memory corruption
- Stale-state vulnerability
- Type confusion
- Severity
- Both vulnerabilities are rated 9.2 under CVSS v4.0 and described as critical.
- Affected Versions
- PHP 8.2 releases before 8.2.35
- PHP 8.3 releases before 8.3.36
- PHP 8.4 releases before 8.4.27
- PHP 8.5 releases before 8.5.12
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Where immediate patching is not feasible, restrict external access to vulnerable systems and apply applicable WAF protections, request filtering, and PHP configuration hardening.
CVE
CVE-2026-109618Two critical remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (nicknamed “PHP2Shell”), are reportedly being targeted in active exploitation attempts following the leak ofCVE-2026-109619Two critical remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (nicknamed “PHP2Shell”), are reportedly being targeted in active exploitation attempts following the leak of
People
Vendors
Products
DrupalBecause the flaws affect PHP itself rather than a specific application, websites running vulnerable PHP versions may be exposed, including those built on WordPress, Drupal, and Joomla.JoomlaBecause the flaws affect PHP itself rather than a specific application, websites running vulnerable PHP versions may be exposed, including those built on WordPress, Drupal, and Joomla.PHPTwo critical remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (nicknamed “PHP2Shell”), are reportedly being targeted in active exploitation attempts following the leak ofWordPressBecause the flaws affect PHP itself rather than a specific application, websites running vulnerable PHP versions may be exposed, including those built on WordPress, Drupal, and Joomla.