Critical PHP remote code execution“php2shell” — CVE-2026-109618 & CVE-2026-109619

What's going on

On 20 October 2026 the PHP security team gave advance notice of an emergency release that fixes two critical vulnerabilities, both rated CVSS v4.0 9.2. The details leaked ahead of the planned coordinated disclosure, and a screenshot and video of a working exploit tool named “php2shell” (credited to Calif.IO) spread across X, Hacker News, and Mastodon. That leak is why you're seeing a flood of links tonight.

The two bugs — CVE-2026-109618 and CVE-2026-109619 — are described by independent researchers as remote code execution in PHP itself, believed to be reachable without authentication. In plain terms: an attacker sends a crafted web request and runs commands on your server. Because the flaw is in the PHP runtime, it affects applications regardless of framework — WordPress, Magento, Joomla, Drupal, Laravel, Symfony, phpBB, MediaWiki, and WHMCS all appeared in the leaked demo.

The official PHP advisory does not yet include technical details or the exact affected and fixed versions — those publish with the release. Everything below is compiled from the official notice plus reporting and analysis from watchTowr, Huntress, Sansec, CERT-EU, and Ars Technica. Where something is not officially confirmed, it's labelled.

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” — PHP security team, official advisory, 20 Oct 2026

Is it being exploited?

• Confirmed real. watchTowr said the vulnerabilities are genuine and that they reproduced CVE-2026-109618.
• A weaponised tool exists. The leaked “php2shell” tool's banner claims it works against every PHP release from 5.4.0 onward; a demo video hit multiple major apps.
• No confirmed widespread in-the-wild exploitation was reported by Huntress or watchTowr at the time of their write-ups. Several researchers sharing the exploit video (e.g. Kirill Firsov) say they consider it in the wild. Treat the gap before patch as an active emergency, not a false alarm.
• Mass exploitation is expected fast. Sansec says it expects attacks “within 15 minutes” of the patch going public, because the fix itself reveals the bug.

Bottom line: the window between now and patch is the time to reduce your attack surface. The window right after patch is when opportunistic scanning will spike — have your update ready to go.

CVE identifiers

Note: some early leaks quoted CVSS 10.0. The official figure from the PHP security team is 9.2 (CVSS v4.0) for each.

Exposure & affected versions

Official affected/fixed versions ship with the release. Based on researcher reporting and the leaked tool's own claims, plan around the following. Verify against the official advisory once it's out.

The leaked tool's banner claims coverage of every PHP release from 5.4.0 onward, and reporting points at PHP 5, 6, 7, and 8. Only currently supported branches (8.2+) are expected to receive a patched build — everything older is exposed with no vendor fix.

Immediate mitigations

You can do all of this before the patch ships. Steps 1–3 are universal and low-risk. Steps 4–5 are an unofficial, reversible stopgap based on independent root-cause analysis (see the note at the end).

1. 1 Inventory every PHP install

   Find every host and version — including PHP bundled inside vendor appliances, control panels, and containers.

   Copy

   php -v        # per host
   # across a fleet, check your package manager / container images too
   # e.g. find web roots, cPanel/Plesk PHP selectors, Docker base images

2. 2 Line up patching now

   Be ready to update the instant the release lands (21 Oct 2026, 14:00 UTC — possibly earlier). If your hosting is managed, open a ticket today and ask your provider to stand by. Target the fixed builds in the supported branches: 8.5 / 8.4 / 8.3 / 8.2.

3. 3 Isolate end-of-life PHP

   PHP 8.1 and older, all of 7.x, and 5.x will likely get no official fix. Take those hosts off the public internet (firewall, VPN-only, or maintenance page) until you can upgrade.

4. 4 Stopgap: disable session.upload_progress unofficial · reversible

   Independent analysis attributes one of the two flaws to a use-after-free in PHP's session.upload_progress handler. Disabling it is low-risk and reversible, and most sites don't rely on it. Add this to php.ini (or .user.ini), then reload PHP-FPM / your web server.

   Copy

   session.upload_progress.enabled = Off

   Then reload so it takes effect:

   Copy

   sudo systemctl reload php8.4-fpm   # match your PHP-FPM service name
   # or: sudo systemctl reload apache2 / nginx

5. 5 Clamp multipart uploads at the edge defence in depth

   The second suspected path runs for any multipart/form-data POST, regardless of the setting above. If you have a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need file uploads. This is a hardening measure, not a guaranteed fix.

6. 6 Patch, then assume-breach review

   After updating to a fixed build, check exposed hosts for signs of compromise (see Detection): new web shells, unexpected cron jobs or services, new users, outbound connections. If you find them, treat it as an incident.

Detection & indicators

There are no public, reliable network signatures yet. The most durable signal (per Huntress and Florian Roth's process-watcher) is a PHP worker spawning a child process it never normally would.

Watch for a PHP process (php-fpm, php-cgi, php-cgi.exe, apache2, httpd) launching:

• Shells: sh, bash, cmd.exe, powershell.exe
• Interpreters: python, perl
• Download / net tools: curl, wget, nc, certutil.exe
• Reverse-shell patterns in command lines: /dev/tcp/, fsockopen, mkfifo
• Recon commands straight from the web server: whoami, id, uname -a, ipconfig

Also review web-server access logs for bursts of multipart/form-data POSTs to endpoints that don't accept uploads.

Reference links

Prioritised toward official and technical sources. Last reviewed 20 Oct 2026.

Official & authoritative

• PHP.net — Upcoming Critical PHP Security Release primary source 20 Oct 2026
• CERT-EU — Critical Vulnerabilities in PHP (2026-018) advisory 20 Oct 2026

Technical analysis & research

• Sansec — Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619 research 21 Oct 2026
• Huntress — Rapid Response: php2shell IR / detection 21 Oct 2026
• J4ck3LSyN — session.upload_progress UAF root-cause analysis unofficial · contains PoC material 20 Oct 2026

News & reporting

• BleepingComputer — PHP warns admins of two critical flaws news 20 Oct 2026
• Ars Technica — PHP plans to release 2 emergency patches imminently news 20 Oct 2026

Researcher & social posts

• Kirill Firsov (@k_firsov) — exploit video, credits, and the pre-patch stopgap researcher · exploit video 20 Oct 2026
• J4ck3LSyN (@j4ck3lsyn) — lab reproduction claim & session.upload_progress root-cause thread researcher · repro claim 20 Oct 2026
• AGTP Insights (@AGTPinsights) — php2shell post commentary 20 Oct 2026

Know a solid technical write-up we're missing? This is a community resource — send it our way and we'll add vetted sources.

FAQ