PHP2Shell: No login, no app code, no warning. What next?

If you run PHP anywhere in your environment, patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Two critical flaws disclosed last week, CVE-2026-109618 and CVE-2026-109619 (nicknamed "PHP2Shell"), let an unauthenticated attacker run code on a server with nothing more than a crafted web request.

Summary from The Register Security.

Explained

The technology and terms in this story. Learn more

Vulnerabilities in this story

Severity and exploitation facts from NVD, FIRST, and CISA.

• CVE-2026-109618Critical 9.2EPSS 100.0%
• CVE-2026-109619Critical 9.2EPSS 100.0%

Related coverage

Other sources covering the same vulnerabilities or event.

PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts

Security Affairs7h agoThreat IntelVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP2Shell security flaws now sucessfully exploited in the wild

BleepingComputer8h agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

The Hacker NewsyesterdayVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP2Shell: Exposure and Response with the CrowdStrike Falcon Platform

VideoCrowdStrike2d agoEndpointVulnerabilitiesCVE-2026-109618CVE-2026-109619

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)

Palo Alto Unit 422d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available

Horizon3.ai2d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1

Canadian Centre for Cyber Security3d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

The Hacker News3d agoThreat IntelVulnerabilitiesCVE-2026-109618CVE-2026-109619

More in Vulnerabilities