Covered by 2 outlets — first reported by Kaspersky Securelist, Oct 21, 15:18 UTC
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
MentionsAmazon Web ServicesKaspersky
In brief
October 29, 2026: We added guidance for end-of-life PHP versions (8.1 and earlier), including the source backports that the PHP security team published for PHP 7.4, 8.0, and 8.1. October 23, 2026 (update 2): The PHP project disclosed CVE-2026-115560, a separate remote code execution issue that the October 21 releases don’t fix. It affects only
From AWS Security Blog's coverage.
Continue reading
2 outlets, in the order they reported it.
Kaspersky SecurelistFirst report
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the PHP2Shell exploit: we’ll walk you through examples using KEDR, KATA, and KES.
AWS Security Blog
Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
October 29, 2026: We added guidance for end-of-life PHP versions (8.1 and earlier), including the source backports that the PHP security team published for PHP 7.4, 8.0, and 8.1.
Explained
The technology and terms in this story. Learn more
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- TechnologyPHPA programming language that powers a large share of websites, including WordPress.
- DefenceWAF · Web application firewallA filter in front of a website that blocks malicious requests such as SQL injection attempts.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.