criticallivepartial fix
chapter · PoCs and mass exploitation
PHP2Shell: critical unauthenticated RCE in PHP core
› PHP
Get an email when a new major security incident drops. No spam, unsubscribe any time.
PoCs and mass exploitation
Public PoCs and broad exploitation attempts after the fix shipped.
PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain).
## summary
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026; exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
read the full incident →## advisories[4]
- Today's PHP Security Release (PHP Foundation)PHP Foundation · Oct 21, 2026
- CISA: Critical Vulnerabilities in PHP Require Immediate PatchingCISA · Oct 21, 2026
- CERT-EU 2026-018: Critical Vulnerabilities in PHPCERT-EU · Oct 21, 2026
- Security advisory: Critical remote code execution vulnerabilities, update nowPHP · Oct 21, 2026
