What is CVE-2026-109618 & CVE-2026-109619?
CVE-2026-109618 & CVE-2026-109619 (known as “php2shell”) are Remote Code Execution vulnerabilities in PHP, a scripting language used to build and run web applications and websites. These vulnerabilities allow an unauthenticated attacker to execute their own code on a server running PHP, potentially taking control of it.
These vulnerabilities affect PHP 5, 7, and 8 in entirety.
| CVE | Description | CVSS | Exploited in the wild |
|---|---|---|---|
| CVE-2026-109618 | Remote Code Execution in PHP | 9.2 (v4.0) | Yes, per watchTowr |
| CVE-2026-109619 | Remote Code Execution in PHP | 9.2 (v4.0) | Yes, per watchTowr |
Is CVE-2026-109618 & CVE-2026-109619 being exploited in the wild?
Exploitation has been observed in the wild as of the 21st of October through watchTowr’s Attacker Eye global honeypot network.
How did CVE-2026-109618 & CVE-2026-109619 come to light?
Information leaked on social media that indicated a security announcement covering two PHP remote code execution vulnerabilities, including CVE-2026-109618 & CVE-2026-109619, was scheduled for October 22, 2026, at 18:00 CEST. The poster said the claim rested solely on trust in that source and had not been independently confirmed at the time of posting.
How is watchTowr helping PHP customers?
- Adversary Sight engine identified PHP instances across client environments and assessed exposure.
- Rapid Reaction identified exposure to this vulnerability across the watchTowr client base, giving teams the time they need to act.
- Active Defense has been leveraged to deploy autonomous investigation capabilities to watchTowr Platform client networks.
What is PHP?
PHP is a scripting language used to build dynamic websites and web applications. Enterprise networks commonly run PHP-based content management systems and internal tools, so servers running PHP often handle customer data and business logic reachable from the internet.
Which PHP versions are affected?
| Product | Affected Versions | Fixed Version |
|---|---|---|
| PHP | 5 and onward | PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 |
- The report claims the vulnerability affects every PHP version from PHP 5 onward, though this scope has not been confirmed by an official vendor advisory.
- No specific configuration or feature requirement has been described in the available report.
Until PHP publishes an official advisory, security teams cannot determine which specific deployments face the greatest exposure; every organization running PHP in production should prepare to act quickly once a fix is confirmed.
How do I fix CVE-2026-109618 & CVE-2026-109619?
No vendor advisory or fixed version exists yet, so there is no confirmed patch or workaround at this time. Security teams should watch for the official PHP security announcement and apply the fixed version promptly once it becomes available.
- Monitor official PHP security channels for the scheduled vendor announcement.
- Inventory every server and application that runs PHP in production.
- Avoid acting on unverified reports until an official advisory confirms the details.
- Prepare a rapid update process for PHP installations ahead of a confirmed fix.
- Apply the vendor’s fixed PHP version promptly once it is released.
What other vulnerabilities does the same bulletin fix?
The same announcement is reported to also include CVE-2026-109619, a second PHP remote code execution vulnerability that the same unverified report describes as affecting every version from PHP 5 onward.
What types of threat actors typically exploit this vulnerability?
No attribution has been made public.
