Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, are being actively exploited.
Unit 42 has identified two critical remote code execution vulnerabilities in PHP, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), with CVSS scores of 9.2. These vulnerabilities allow attackers to achieve RCE by exploiting out-of-memory errors or fatal error handling that leaves global memory pointing to freed regions. The vulnerabilities are being actively exploited, chained with a Linux kernel privilege-escalation vulnerability to gain root access, and have been observed targeting internet-exposed PAN-OS management interfaces.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Palo Alto Networks?
Get an email when a new story names Palo Alto Networks, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTwo critical remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), scoring 9.2 on the CVSS scale, are being actively exploited in the wild. Attackers exploit unsafe memory handling — specifically out-of-memory errors and fatal error handling that leaves global memory pointing to freed regions — to execute arbitrary code. These flaws are being chained with a Linux kernel privilege-escalation vulnerability to achieve full root access, with confirmed targeting of internet-exposed PAN-OS management interfaces. This incident highlights the compounding danger of unpatched application-layer vulnerabilities when combined with kernel-level weaknesses, and the critical importance of restricting public exposure of management interfaces.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-109618
- cve — CVE-2026-109619