Executive Summary
On October 20, 2026, technical details for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were leaked online before the coordinated disclosure date. The PHP security team has assigned these flaws a CVSS v4.0 score of 9.2, indicating a high risk of remote code execution (RCE). While no active in-the-wild exploitation has been confirmed as of the leak date, researchers have successfully reproduced at least one of the flaws.
The vulnerabilities are reported to affect PHP versions 5 through 8, though official confirmation on the range of affected versions and available patches is pending the emergency security release scheduled for October 21. There is significant concern that end-of-life (EOL) versions of PHP may not receive security updates, leaving a vast number of legacy web applications and vendor appliances vulnerable to complete server compromise.
Given the ubiquity of PHP in content management systems like WordPress and Drupal, organizations should immediately inventory all PHP deployments. Immediate patching is required upon release, and EOL systems should be isolated or placed behind strict access controls.
Key Details
Threat Name
php2shell
Affects
PHP
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified