Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.

Summary from Huntress Blog.

Explained

The technology and terms in this story. Learn more

Vulnerabilities in this story

Severity and exploitation facts from NVD, FIRST, and CISA.

• CVE-2026-109618Critical 9.2Known exploitedEPSS 100.0%
• CVE-2026-109619Critical 9.2Known exploitedEPSS 100.0%

Related coverage

Other sources covering the same vulnerabilities or event.

PHP2Shell: Exposure and Response with the CrowdStrike Falcon Platform

VideoCrowdStrike11h agoVulnerabilitiesEndpointCVE-2026-109618CVE-2026-109619

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

Palo Alto Unit 4211h agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2

Canadian Centre for Cyber Security2d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP security advisory (AV26-1070) - Update 1

Canadian Centre for Cyber Security2d agoVulnerabilitiesCVE-2026-109618

U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog

Security Affairs2d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The Hacker News3d agoVulnerabilitiesAppSecCVE-2026-109618

PHP2Shell: What to know about two critical PHP flaws

ESET WeLiveSecurity3d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Advisories3d agoVulnerabilitiesGovernanceCVE-2026-109618CVE-2026-109619

More in Vulnerabilities