Covered by 5 outlets — first reported by Datadog Security Labs, Oct 21, 00:00 UTC
PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
In brief
October 29, 2026: We added guidance for end-of-life PHP versions (8.1 and earlier), including the source backports that the PHP security team published for PHP 7.4, 8.0, and 8.1. October 23, 2026 (update 2): The PHP project disclosed CVE-2026-115560, a separate remote code execution issue that the October 21 releases don’t fix. It affects only
From AWS Security Blog's coverage.
Continue reading
5 outlets, in the order they reported it.
Datadog Security LabsFirst report
PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
Learn about the two critical vulnerabilities in PHP dubbed PHP2Shell.
Huntress Blog
Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.
Google Cloud Security
Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Editor's note : This blog was updated on Oct. 23, 2026 at 3:20 p.m. PDT, with additional guidance from Mandiant Consulting on monitoring, patching, and remediation. We have previously updated the blog on Oct.
Kaspersky Securelist
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the PHP2Shell exploit: we’ll walk you through examples using KEDR, KATA, and KES.
AWS Security Blog
Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
October 29, 2026: We added guidance for end-of-life PHP versions (8.1 and earlier), including the source backports that the PHP security team published for PHP 7.4, 8.0, and 8.1.
Explained
The technology and terms in this story. Learn more
- TechnologyPHPA programming language that powers a large share of websites, including WordPress.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- DefenceWAF · Web application firewallA filter in front of a website that blocks malicious requests such as SQL injection attempts.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.