Vulnerability · Global · October 2026

PHP2Shell: Critical Remote Code Execution in PHP (CVE-2026-109618, CVE-2026-109619)

Two critical unauthenticated remote code execution flaws in PHP prompted emergency releases and joint warnings from ENISA, CERT-EU, the FBI and the NSA.

Incident

What happened

On 21 October 2026 the PHP project released emergency security updates (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) fixing two critical vulnerabilities rated CVSS 9.2, tracked collectively as PHP2Shell.

CVE-2026-109618 allows remote code execution through memory corruption during out-of-memory handling; CVE-2026-109619 is a stale-state use-after-free. Both can be triggered by unauthenticated requests before application code runs, with the highest risk on Apache with mod_php.

ENISA, the European Commission, CERT-EU, Europol EC3 and the EU CSIRTs network issued a joint statement urging immediate patching, while the FBI and NSA published parallel warnings. Security researchers observed reconnaissance and probing of PHP applications within hours of disclosure.

Analysis

Lessons learned

Internet-facing PHP systems must be patched immediately; where patching is not possible, isolate exposed applications from public networks until fixes are applied and verified.

PHP 8.1 and older no longer receive updates from the PHP project, so unsupported versions must be upgraded or covered by vendor backports.

Many commercial and open-source products embed PHP in the background; an accurate software inventory is needed to find affected systems that do not appear to use PHP directly.

Prevention

How penetration testing helps

Web application and network penetration testing identify exposed PHP services, outdated runtime versions and vulnerable components, and verify that patching and isolation measures are actually effective.

Sources

Summary based on publicly available information. DIGITPOL was not involved in this incident.