PHP2Shell: What to know about two critical PHP flaws

Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes

Summary from ESET WeLiveSecurity.

Explained

The technology and terms in this story. Learn more

Vulnerabilities in this story

Severity and exploitation facts from NVD, FIRST, and CISA.

• CVE-2026-109618Critical 9.2Known exploitedEPSS 100.0%
• CVE-2026-109619Critical 9.2Known exploitedEPSS 100.0%

Related coverage

Other sources covering the same vulnerabilities or event.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Advisories17h agoVulnerabilitiesGovernanceCVE-2026-109618CVE-2026-109619

PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts

Security Affairs19h agoThreat IntelVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP2Shell security flaws now sucessfully exploited in the wild

BleepingComputer20h agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP2Shell: No login, no app code, no warning. What next?

The Register Security21h agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

The Hacker NewsyesterdayVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP2Shell: Exposure and Response with the CrowdStrike Falcon Platform

VideoCrowdStrike3d agoEndpointVulnerabilitiesCVE-2026-109618CVE-2026-109619

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)

Palo Alto Unit 423d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available

Horizon3.ai3d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

More in Vulnerabilities