VulnerabilitiesOct 21, 2026

PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) are patched after exploitation attempts.

PHP has released patches for two critical-severity vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), allowing unauthenticated remote code execution. Exploitation attempts were observed in the wild by multiple security firms, including before the patches were available. These vulnerabilities, affecting nearly all PHP releases back to version 5.4, could also lead to the exposure of sensitive process memory like credentials and API keys.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run PHP Foundation?

Get an email when a new story names PHP Foundation, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Two critical unauthenticated remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were actively exploited in the wild before patches were even released, highlighting the danger of zero-day exposure windows in widely-deployed software. The flaws affect nearly all PHP versions back to 5.4, meaning a vast portion of the internet's web infrastructure was at risk simultaneously. Beyond code execution, these vulnerabilities could leak sensitive process memory including credentials and API keys, compounding the potential damage. This incident underscores why organizations must treat critical vulnerability disclosures as emergency events requiring immediate response, not routine patch cycles.

What helps against this

How we list vendors

Cloudflare research Vega research watchTowr research

Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleQualys VMDR Tenable Vulnerability Management Axonius Exposures all options
Automated patch management
Known holes get closed in days, not months.
For exampleManageEngine Patch Manager Plus Ivanti Neurons for Patch Management Qualys Patch Management all options
Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleDataminr Agentic Threat Intelligence Platform CrowdStrike Falcon Adversary Intelligence Dataminr Threat Intelligence all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

cve — CVE-2026-109618
cve — CVE-2026-109619

Entities

PHP (product)PHP Foundation (vendor)Apache (product)mod_php (product)PHP-FPM (product)php-cgi (product)