PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation

Learn about the two critical vulnerabilities in PHP dubbed PHP2Shell.

Summary from Datadog Security Labs.

Explained

The technology and terms in this story. Learn more

Vulnerabilities in this story

Severity and exploitation facts from NVD, FIRST, and CISA.

• CVE-2026-109618Critical 9.2EPSS 100.0%
• CVE-2026-109619Critical 9.2EPSS 100.0%

Related coverage

Other sources covering the same vulnerabilities or event.

PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

The Hacker News13h agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP2Shell: Exposure and Response with the CrowdStrike Falcon Platform

VideoCrowdStrike2d agoEndpointVulnerabilitiesCVE-2026-109618CVE-2026-109619

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)

Palo Alto Unit 422d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available

Horizon3.ai2d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1

Canadian Centre for Cyber Security2d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

The Hacker News2d agoThreat IntelVulnerabilitiesCVE-2026-109618CVE-2026-109619

SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More

Podcast13 minSANS Internet Storm Center StormCast4d agoAppSecNetworkVulnerabilitiesCVE-2026-109618CVE-2026-109619

Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

AWS Security Blog4d agoAppSecNetworkVulnerabilitiesCVE-2026-109618CVE-2026-109619+1

More in Vulnerabilities