Alerts

Critical Vulnerabilities in PHP (PHP2Shell)

21 October 2026

Attackers can exploit multiple critical vulnerabilities in PHP to achieve unauthenticated remote code execution. Patch immediately.

Last Updated: 22 October 2026

Background

PHP is a widely used scripting language in many websites and web applications. Security updates have been released to address two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP, collectively known as PHP2Shell. Both vulnerabilities have a Common Vulnerability Scoring System (CVSS v4.0) score of 9.2 out of 10.

Impact

Successful exploitation of these vulnerabilities could result in the following:

CVE-2026-109618: An out-of-memory handling vulnerability that could allow an unauthenticated remote attacker to execute arbitrary code on affected systems.

CVE-2026-109619: A use-after-free vulnerability that could allow an unauthenticated remote attacker to execute arbitrary code on affected systems.

Known Exploitation

There have been reports of widespread exploitation attempts targeting these vulnerabilities, as well as the development of multiple proof-of-concept (PoC) exploits.

Affected Products

These vulnerabilities affect all versions of PHP.

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately. If an affected product cannot be immediately updated, refer to PHP's guidance available at https://www.php.net/archive/2026.php#2026-10-21-5 (opens in new tab) for temporary measures to reduce exposure to specific attack paths.

Organisations are advised to identify systems running any version of PHP and apply the security updates, prioritising internet-facing systems. Organisations should further check whether PHP is installed on their web servers, including where it may be used by third-party applications or components, even if their primary websites do not use PHP.

Organisations should also continue to monitor PHP's official guidance for updates.

References