PHP2Shell

CVE-2026-109618 and CVE-2026-109619 are two vulnerabilities in PHP that allow remote code execution and are together known as PHP2Shell. The existence of the vulnerability was publicly announced on 20 October 2026.[1] An emergency patch and details about the vulnerability were released on the following day.[2]

The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project, and by the Israeli-American cloud security company Wiz, Inc.[3][4] According to Wiz, versions as early as PHP 5.4, all the way through to PHP 8, are affected.[5]

The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers,[6] while security firm watchTowr rated it a full 10.0.[7]

The maintainers of PHP worked with companies including Wiz, Cloudflare, and OpenAI to develop and release patched version of PHP 8.2, 8.3, 8.4, and 8.5.[3][2] Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life.[2] Both vulnerabilities were published through GitHub security advisories[8][9] on 21 October at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter.

The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and were confirmed by the X account of cybersecurity company watchTowr labs.[10] The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released.[10][1] One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release".[11] PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo.[7][12] Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability.[13][14]

This software-engineering-related article is a stub. You can help Wikipedia by adding missing information.