PHP2Shell Vulnerabilities

Heloise Meyer | Oct. 22, 2026, 7:22 a.m.

Further information on the PHP2Shell Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge [Swati Khandelwal, The Hacker News]

Today's PHP Security Release, and How We're Strengthening PHP Security [The PHP Foundation, The PHP Foundation]

Patch Now: php2shell: What We Know About the Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) [Check Point Research Team, Check Point]

PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 [Jonathan Greig, The Record]