PHP2Shell: What to know about two critical PHP flaws

Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes

Summary from ESET WeLiveSecurity.

Explained

The technology and terms in this story. Learn more

Vulnerabilities in this story

Severity and exploitation facts from NVD, FIRST, and CISA.

• CVE-2026-109618Critical 9.2Known exploitedEPSS 100.0%
• CVE-2026-109619Critical 9.2Known exploitedEPSS 100.0%

Related coverage

Other sources covering the same vulnerabilities or event.

PHP2Shell: Exposure and Response with the CrowdStrike Falcon Platform

VideoCrowdStrike11h agoVulnerabilitiesEndpointCVE-2026-109618CVE-2026-109619

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

Palo Alto Unit 4211h agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2

Canadian Centre for Cyber Security2d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP security advisory (AV26-1070) - Update 1

Canadian Centre for Cyber Security2d agoVulnerabilitiesCVE-2026-109618

U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog

Security Affairs2d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The Hacker News3d agoVulnerabilitiesAppSecCVE-2026-109618

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Advisories3d agoVulnerabilitiesGovernanceCVE-2026-109618CVE-2026-109619

PHP2Shell: No login, no app code, no warning. What next?

The Register Security3d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

More in Vulnerabilities