Advisory
22 October 2026
Background
CVSS Score: Base 9.2 Critical
Two critical remote code execution (RCE) vulnerabilities, collectively known as PHP2Shell, have been identified in PHP, a widely used server-side scripting language for web applications.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have each been assigned a CVSS v4.0 score of 9.2 (Critical). These vulnerabilities involve memory-handling weaknesses within the PHP engine that could allow unauthenticated remote attackers to execute arbitrary code on affected servers or expose sensitive process memory.
Successful exploitation could compromise the confidentiality, integrity and availability of affected systems. Emergency security updates were released on 21 October 2026 to address these vulnerabilities.
Impact
Successful exploitation of these vulnerabilities could result in:
- Execution of arbitrary code on vulnerable servers without authentication.
- Unauthorised access to affected systems and potential compromise of connected resources.
- Theft of sensitive information, including application data and credentials.
- Service disruption, including application crashes, system instability or service unavailability.
- Installation of malicious tools to maintain unauthorised access.
Affected Products
| PHP Version | Fixed Version | |
|---|---|---|
| 1 | PHP 8.5 | Versions prior to 8.5.12 |
| 2 | PHP 8.4 | Versions prior to 8.4.27 |
| 3 | PHP 8.3 | Versions prior to 8.3.36 |
| 4 | PHP 8.2 | Versions prior to 8.2.35 |
| 5 | PHP 8.1 and earlier | Unsupported versions requiring vendor assessment or migration |
Recommendations
- Identify all systems running PHP, including third-party products that bundle PHP, and prioritise internet-facing systems for assessment and patching.
- Immediately upgrade affected PHP installations to the latest patched versions or apply verified vendor-provided security fixes.
- Implement appropriate Web Application Firewall (WAF) protections, restrict unnecessary network access and enforce the principle of least privilege.
- Migrate end-of-life PHP installations to supported, patched releases, or obtain vendor-supported security fixes where available. If updates cannot be applied immediately, follow the PHP team’s temporary mitigation guidance.
- Review web server logs, PHP error logs and security monitoring alerts for unusual requests, unexpected processes and potential indicators of compromise.
- Investigate affected systems for signs of unauthorized access, suspicious file modifications, malicious scripts or unexpected system activity.
References
- https://www.php2shell.com/ PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web
- https://www.php.net/archive/2026.php#2026-10-21-5
- https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
- https://www.wiz.io/blog/php2shell-php-rce
- https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
- https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce
