Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Two critical vulnerabilities in the PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, let an unauthenticated attacker run commands on servers that use an affected PHP build to handle web requests. PHP released fixes on October 21, 2026, a day after details leaked online. Public proof-of-concept code followed within hours, and exploitation attempts were seen as early as October 17. AppTrana customers have been protected against PHP2Shell.

On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to by researchers as PHP2Shell. Both vulnerabilities carry a CVSS v4.0 score of 9.2 (Critical Severity) and can allow an unauthenticated attacker to execute code with the privileges of the affected PHP worker process.

Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, allow attackers to execute code on vulnerable web servers without authentication. PHP released fixes on October 21, 2026, including versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. But patching your servers is only part of the response. Organizations must also understand what their websites delivered to customers during the exposure window, including scripts served by third-party vendors whose infrastructure may have been vulnerable.

On Oct. 21, 2026, PHP fixed a vulnerability named php2shell by Calif. Pre-auth RCE under default configurations, confirmed on common CMS, webmail, e-commerce, file sharing, and database administration applications. A PHP server also stores and uses credentials, so this is a secret theft vector.

Last updated: October 22, 2026. This story is still developing, and we'll update this post as new details are confirmed. Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are putting a large share of the web at risk. The vulnerabilities, collectively named PHP2Shell, both carry a CVSS score of 9.2, and both allow remote code execution (RCE). Security teams should treat these vulnerabilities urgently and respond accordingly.

Accelerating security solutions for small businesses‍ Tagore offers strategic services to small businesses. A partnership that can scale‍ Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate. Standing out from competitors‍ Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market.

On October 21, 2026, two critical vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were publicly disclosed. Both are rated 9.2 and both allow remote code execution on vulnerable servers. Government portals, public services, and commercial sites across multiple countries went offline as a precaution while teams rushed to patch. But the flaws were known on October 20, and the patch didn’t ship until the 21st.

An emergency vulnerability response begins before the patch arrives. On 20 October 2026, the PHP project announced two critical vulnerabilities, each rated CVSS v4.0 9.2, but withheld the technical details security teams would normally use to assess exposure. Organizations had a release window to prepare for, but no confirmed affected versions or attack vector.

The chain should be assessed as a browser-mediated deployment mechanism rather than a traditional server-side exploit. The decisive condition is an already authenticated WordPress administrator browser; that context lets the loader reuse legitimate site-management workflows and turn a successful interaction into persistent server-side access.

On October 21, 2026, the PHP project published fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 and collectively known as php2shell. Since then, we have received questions about what to do.