PHP2Shell
CVE-2026-109618 · CVE-2026-109619Critical PHP2Shell flaws allow remote code execution on servers
PHP2Shell is a pair of critical memory-handling bugs in the PHP programming language. They let an attacker remotely run their own code on a vulnerable web server. The US cybersecurity agency CISA has confirmed the bugs are under active attack and fixed versions are available.
PHP Group PHP · Updated 28 Oct · From 6 of our stories and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 26 Oct; US agencies must fix by 29 Oct
SeveritycriticalCVSS 9.2 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
What to do
- Update PHP to the latest fixed version: 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on your PHP branch.
- Run the free detection tools released by Astra Security to find vulnerable PHP installations.
- Rotate API keys and cloud credentials as a precaution against credential theft, following the advice given after related breaches.
What happened
- 22 OctCloud platform Railway is breached and tells users to rotate API keys.
- 23 OctThe PHP Foundation discloses two critical PHP2Shell flaws and releases emergency patches.
- 23 OctA third related PHP2Shell vulnerability is announced, but an emergency patch is not released.
- 24 OctCybersecurity authorities, including CISA, confirm the two vulnerabilities are being actively exploited.
- 24 OctSecurity firm Astra Security releases free tools to detect PHP2Shell on servers.
- 26 OctA hacker successfully exploits the PHP2Shell flaws in a public Bitcoin bounty challenge.
- 26 OctCISA adds both PHP2Shell flaws to its Known Exploited Vulnerabilities catalog.
- 27 OctMajor technology vendors like Cisco and Palo Alto Networks begin assessing their exposure to PHP2Shell.
The 2 records
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-109618 | RCE via OOM corruption | critical 9.2 | 26 Oct | 100% |
| CVE-2026-109619 | RCE via stale global state | critical 9.2 | 26 Oct | 100% |
Our reporting
26 OctHacker cracks vulnerable PHP server in Bitcoin bounty challenge24 OctChainguard's early PHP disclosure sparked scramble, CISA confirms exploits underway24 OctAstra Security releases free tools to detect PHP2Shell vulnerabilities23 OctThird PHP2Shell vulnerability found, but no emergency fix planned23 OctAI-discovered PHP bug forces global patch as exploit attempts hit millions22 OctDeveloper platform Railway urges all users to rotate API keys after cyberattackReported elsewhere
Palo Alto Networks · 28 OctCVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL) ↗The New Stack · 27 Oct“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response ↗www.theregister.com - Articles · 27 OctCISA confirms PHP2Shell under attack as researchers clock successful exploits ↗Cisco · 27 OctVulnerabilities in PHP Affecting Cisco Products: October 2026 ↗BleepingComputer · 27 OctCISA confirms PHP2Shell vulnerabilities now exploited in attacks ↗The Hacker News · 27 OctCISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution ↗CryptoSlate · 26 OctBitcoin hacking challenge finally falls as researcher proves critical PHP flaw is exploitable ↗CISA · 26 OctCISA Adds Two Known Exploited Vulnerabilities to Catalog ↗Latest from Tom's Hardware · 26 OctBitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty ↗BleepingComputer · 26 OctPHP2Shell security flaws now sucessfully exploited in the wild ↗www.theregister.com - Articles · 26 OctPHP2Shell: No login, no app code, no warning. What next? ↗InfoQ · 25 OctPHP Patches Two Critical RCE Flaws That Were Already Under Attack ↗The Hacker News · 23 OctPHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware ↗Rapid7 · 21 OctCVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP ↗CISA · 21 OctCritical Vulnerabilities in PHP Require Immediate Patching ↗UK NCSC · 21 OctCritical security issue affecting PHP ↗Fortinet · 21 OctPHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619) ↗The records
github.com: advisory ↗github.com: advisory ↗CISA known-exploited catalog ↗CVE-2026-109618 on NVD ↗CVE-2026-109619 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works