VULNERABILITYAikido Security's Blog
What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Two critical remote code execution vulnerabilities have been found in PHP itself. Treat all versions as affected.The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both have a CVSS v4.0 score of 9.2. The PHP security team will release fixes on October 21, 2026, at 16:00 CEST / 10:00 EDT / 07:00 PT.If you run PHP anywhere in your stack, please stay tuned for workarounds and patches. We are working with the PHP Foundation and security comunity to coordinate the release of patches and further information.
Sources
- Aikido Security's Blog · 21-Oct-2026