Executive Summary
On October 20, 2026, details regarding two critical remote code execution (RCE) vulnerabilities in PHP core, designated as CVE-2026-109618 and CVE-2026-109619, were leaked online before their scheduled coordinated disclosure. The vulnerabilities, nicknamed "php2shell," have a CVSS v4.0 rating of 9.2 and potentially affect PHP versions 5 through 8. While the official security release was moved up to October 21, the leak has left a window of exposure where technical details are public but patches may not yet be deployed across all environments.
Technically, the flaws reside in the PHP core, potentially allowing unauthenticated attackers to execute arbitrary commands via crafted web requests. Security researchers have confirmed the validity of the flaws and reproduced RCE on CVE-2026-109618. Although no wide-scale exploitation has been confirmed as of this report, the impact is significant due to PHP's ubiquitous presence in web infrastructure, including WordPress, Drupal, and custom enterprise software.
The business impact is severe, particularly for organizations running end-of-life (EOL) PHP versions (5.x, 7.x, 8.0/8.1) which may not receive official patches. Immediate inventory and isolation of internet-facing PHP environments are required to mitigate the risk of full server compromise and subsequent lateral movement within the network.
Key Details
Threat Name
php2shell
Affects
PHP, PHP versions 5 through 8
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified