CVE-2026-109618

PHP runs most of the web. On 21 October 2026 it got a critical security hole called PHP2Shell. It is two bugs inside PHP itself (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 out of 10. An attacker needs no login. Your code can be perfect and the server is still exposed. https://t.co/I9ZuRNE…

A critical flaw in PHP itself went public on 21 October 2026. It's called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), it is rated 9.2 out of 10, and it allows unauthenticated remote code execution on unpatched servers. Exploitation has already been reported. #PHP #PHP2Shell

PHP2Shell: guía completa de verificación, mitigación y respuesta (CVE-2026-109618 y CVE-2026-109619) Vía: @SeguInfo https://t.co/PNzsuc6cvu https://t.co/UHIOmO6aAr

En realidad si lo habían visto y fue un humano en 2024, lo que no encontraron fue como explotarlo, pero conocían el fallo. La IA averiguó como explotar el fallo que ya conocían. Durante una auditoría realizada por Quarkslab, un desarrollador del núcleo de PHP detectó un problema de gestión de memor…

Builders — while everyone is patching PHP2Shell, let's talk about why it happened. 2 days ago: PHP dropped emergency patches CVE-2026-109618 + CVE-2026-109619 — CVSS 9.2. 22.6M servers exposed. Amazon saw exploit in wild Oct 17, 4 days BEFORE patch. Root cause in plain English: PHP runs out of memo…

This week in AI (Oct 19-23): models found a critical hole in the web's most common server language, agents were pointed at thousands of tenants, and banks started shutting agents out. The checks around agents are what moved fastest. Five developments worth following: 1. AI-found PHP flaws force eme…

PHP2Shell: The FBI issued a public service announcement on CVE-2026-109618/109619 on Oct 23. It says to update PHP now, inventory products that bundle PHP, take systems offline if updating isn't feasible, monitor for PHP processes spawning shells, and report compromises to IC3. https://t.co/moqsaEc…

【緊急セキュリティ情報】PHPに重大な脆弱性（CVE-2026-109618／109619） サイト運営者はPHPの版を確認し、修正版（8.5.12・8.4.27・8.3.36・8.2.35以降）へ早めに更新を。 見るだけの方は更新不要です。便乗した偽メールに注意を。 60秒動画と対策👇 https://t.co/mKoMafUhKx #PHP #セキュリティ https://t.co/UZygeVPjmv

PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Critical PHP Core RCE Analysis PHP2Shell is a pair of critical memory-safety bugs in the PHP engine itself (not in WordPress, Laravel, plugins, or app code). An unauthenticated attacker can trigger remote code execution simply by sending crafted HTTP…

Die National Security Agency fordert Organisationen mit PHP-Systemen auf, ein Update gegen zwei kritische Schwachstellen vorzubereiten oder betroffene Systeme offline zu nehmen. Die NSA veröffentlichte am 21. Oktober 2026 eine entsprechende Advisory und kündigte kurzfristig detailliertere Anleitung…

imaginal/docker-php74-trixie: Docker Image php:7.4-fpm with security fixes for CVE-2026-109618 and CVE-2026-109619 updated to build and run on Debian Trixie

CyberRick-AI/php2shell-check: Passive, self-hosted PHP vulnerability exposure scanner (PHP2Shell CVE-2026-109618/109619, CVE-2026-115560) with a plain-English patch report. PWA, CLI, Docker. Zero dependencies.

Ghost-Bx1/php-exploits-CVE-2026-109618-CVE-2026-109619-CVE-2024-4577: Full exploits and PoCs for php2shell (CVE-2026-109618, CVE-2026-109619) and CVE-2024-4577 - PHP critical RCE (CVSS 9.2-9.8)

GetPageSpeed/php2shell-check: Backport-aware PHP2Shell (CVE-2026-109618/109619) checker for installed PHP packages; knows distro and vendor fixed builds, incl. patched PHP 5.6-8.4 for CentOS 7

manteiga-foundation/php2shell-labs: Is your server exposed to PHP2Shell? Free, open-source exposure test and consent-gated exploit validation for CVE-2026-109618 / CVE-2026-109619. Web, API and CLI.

ihsansencan/Php2Shell-Lab: Educational Docker lab for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP 8.4.x

pruthvi0820-cell/phpguard: Defensive toolkit for PHP servers after PHP2Shell (CVE-2026-109618/9): fleet patch audit incl. distro backports & end-of-life PHP, php.ini hardening, owner-only website leak check, and access-log attack detection with canary traps. A–F graded, fix-first reports. Python, n…

Filipegabri/RodMapAuditoriaweb: Metodologia completa de auditoria web - 7 fases - PHP2Shell RCE CVE-2026-109618, Wazuh Baseline 17 regras, MITRE ATT&CK - Por Filipe Gabriel SOC Analyst Luanda

KtebhTeam/php2shell: Hybrid PHP2Shell Security Toolkit (CVE-2026-109618 & 109619). Features an automated vulnerability scanner, session-state analyzer, and application upload handler validator. For authorized security testing only.

Nguemoue/project2026_20261023_php_rce_guard: Vérifie si une version PHP est encore exposée aux RCE du 21 octobre 2026 (CVE-2026-109618, CVE-2026-109619) et rappelle le suivi CVE-2026-115560.

How the Planet Gets Hacked in Seconds (and Why Updating Isn't Optional) — How the Planet Gets Hacked in Seconds (and Why Updating Isn't Optional) You don't get a month to patch anymore. You get hours. Sometimes you don't even get that. On October 21, 2026, PHP shipped emergency fixes for PHP2Shell,…

Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | Amazon Web Services — New technical findings make the PHP2Shell situation more serious than the original patch announcement alone suggested. Amazon Threat Intelligence identified attempted exploitati…

PHP2Shell: the useful question isn't "are we patched", it's "where is PHP actually running in our environment" — Quick recap for anyone catching up. The leaked PHP RCEs (CVE-2026-109618 and CVE-2026-109619) were exploited before the fix landed. AWS's MadPot honeypots saw an attempt on 17 Oct, and t…

php2shell-lab — a black-box Docker range for PHP2Shell (CVE-2026-109618/19) with a closing heap-leak window — I built a reproducible, engine-level practice range for PHP2Shell and put it on GitHub. Not another "run the PoC" box: Black-box by design — no Server: PHP, no phpinfo, version fingerprinti…

PHP2Shell: the leaked PHP RCE everyone is staging and no one has landed (yet) — The php2shell leak (CVE-2026-109618 / 109619, CVSS 9.2) had everyone scrambling. We mapped the exposure (hundreds of thousands of PHP hosts, mostly on end-of-life versions) and went looking at what attackers are doing w…

php2shell exploitation reality: why the public PoCs are not landing shells — The leaked php2shell bugs (CVE-2026-109618 / 109619) hand you an OOM-driven memory corruption primitive in PHP core, but turning that into code execution is where it stalls. The public PoCs making the rounds are lab-only.…

PHP2Shell was probed 4 days before disclosure. Is anyone doing a look-back hunt, not just patching? — Quick recap for anyone catching up. AWS says its honeypots saw a PHP2Shell (CVE-2026-109618/109619) exploit attempt on 17 Oct, four days before the embargo lifted, from anonymised infrastructure (A…

PHP2Shell: patching priorities, exposure checks, and the limits of virtual patching — CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, can allow unauthenticated remote code execution through memory corruption and request lifecycle issues in PHP. For defenders, a key challenge i…

Two critical PHP RCE flaws, tracked as PHP2Shell, leaked ahead of coordinated disclosure. — → CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CVSS v4.0) → PHP’s security release is scheduled for October 21 at 14:00 UTC → Fixes are coming for supported branches 8.2 through 8.5 → End-of-life ver…

PHP2Shell was probed 4 days before disclosure. Is anyone doing a look-back hunt, not just patching? — Quick recap for anyone catching up. AWS says its honeypots saw a PHP2Shell (CVE-2026-109618/109619) exploit attempt on 17 Oct, four days before the embargo lifted, from anonymised infrastructure (A…