PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP fixed both on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Wiz Research combined the two flaws into one exploit script named PHP2Shell. CISA states they allow unauthenticated remote code execution on all PHP installations serving web requests.
Updated
| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-109618KEV RCE via OOM corruption | RCE via OOM corruption | PHP Group | 9.2 | 100.0% | KEV | 2026-10-21 |
| CVE-2026-109619KEV RCE via stale global state | RCE via stale global state | PHP Group | 9.2 | 100.0% | KEV | 2026-10-21 |
PHP Memory Corruption Vulnerability
Part of the PHP2Shell pair of PHP core flaws fixed on October 21, 2026; this CVE is the out-of-memory corruption flaw, where request cleanup can treat partially initialized data as valid. Wiz Research combined both flaws into one exploit script named PHP2Shell. CISA states they allow unauthenticated remote code execution on all PHP installations serving web requests.
PHP Stale Internal Request-State Vulnerability
Part of the PHP2Shell pair of PHP core flaws fixed on October 21, 2026; this CVE is the stale global state flaw, where request-owned state can outlive its memory and reach a later request on the same worker. Wiz Research combined both flaws into one exploit script named PHP2Shell. PHP rates the risk highest for Apache with mod_php.
| CVE | Added | Due | Ransomware |
|---|---|---|---|
| CVE-2026-109618 | 2026-10-26 | 2026-10-29 | - |
| CVE-2026-109619 | 2026-10-26 | 2026-10-29 | - |
| CVE | Vendor | Product | Versions |
|---|---|---|---|
| CVE-2026-109618 | PHP Group | PHP | 8.2.* to <8.2.35 8.3.* to <8.3.36 8.4.* to <8.4.27 8.5.* to <8.5.12 |
| CVE-2026-109619 | PHP Group | PHP | 8.2.* to <8.2.35 8.3.* to <8.3.36 8.4.* to <8.4.27 8.5.* to <8.5.12 |
PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP fixed both on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Wiz Research combined the two flaws into one exploit script named PHP2Shell. CISA states they allow unauthenticated remote code execution on all PHP installations serving web requests.
PHP2Shell covers two CVEs: CVE-2026-109618 and CVE-2026-109619.
2 of the 2 PHP2Shell CVEs are in the CISA Known Exploited Vulnerabilities catalog as of 2026-11-03: CVE-2026-109618 (added 2026-10-26) and CVE-2026-109619 (added 2026-10-26).
The highest CVSS base score among the PHP2Shell CVEs is 9.2 (CRITICAL), for CVE-2026-109618.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.