PHP2Shell is the name given to two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP versions 5.4 through 8.5. Public disclosure took place on 20 October 2026. The flaws received a severity score of 9.2 out of 10 on the CVSS v4.0 scale and allow unauthenticated remote code execution on vulnerable servers.
PHP and Remote Code Execution
PHP is a server-side scripting language used to process web requests and run functions on servers. Remote code execution (RCE) allows an attacker to run code on a targeted system from another location. In PHP2Shell, attackers do not need login credentials to attempt to execute code on an affected server. A successful intrusion could expose data or give an attacker access to parts of a vulnerable system.
Security Updates and Vulnerability Response
The PHP Foundation released emergency updates on 21 October 2026, one day earlier than planned. The patched releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The early release followed information leaks and the accidental publication of a proof-of-concept exploit video. The National Security Agency, the Cybersecurity and Infrastructure Security Agency (CISA) and CERT-EU advised organisations to apply the patches or take vulnerable systems offline.
European Website Outages
Government, school and hospital websites in Germany, France, Belgium, the Netherlands, Finland and the United Kingdom were temporarily taken offline on 21–22 October as a precaution. Officials in Germany, the Netherlands and Japan stated that they had not observed successful breaches. Cloudflare recorded thousands of exploitation attempts in the ten hours before public disclosure and millions afterwards.
Important Facts for Exams
- CVE-2026-109618 and CVE-2026-109619 are the identifiers assigned to the two PHP2Shell vulnerabilities.
- CVSS v4.0 is a system for scoring the severity of cybersecurity vulnerabilities.
- The PHP Foundation issued patched releases for four PHP version branches on 21 October 2026.
- Amazon Threat Intelligence detected an exploitation attempt through its MadPot telemetry network on 17 October 2026.
Cybersecurity Monitoring and Exploitation
Researchers at Calif and Google cybersecurity firm Wiz identified the flaws independently in mid-August 2026, using AI tools including GPT-5.6 Sol, Gemini 4 Argon and Wiz Atlas. Amazon Threat Intelligence detected an attempted exploitation four days before public disclosure, while additional attempts from multiple actors were detected on 21 October. The PHP Foundation described the delay in addressing an earlier vulnerability with the same root cause, identified in 2024, as a structural failure linked to security-team decisions and limited resources.
Applying a security patch does not establish whether a server was compromised before the update. Organisations may need to examine system activity and logs to determine whether unauthorised access occurred.
