PHP2Shell: Critical Vulnerabilities in PHP

Update, 11:18 CEST: Exploitation has been reported in the wild, and the previously suggested configuration mitigations do not protect against these vulnerabilities. See “How to fix this” below.

Two critical remote code execution vulnerabilities have been found in PHP itself. Treat all versions as affected, with reports going back to 5.x.

‍The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both have a CVSS v4.0 score of 9.2. The PHP security team will release fixes on October 21, 2026, at 16:00 CEST / 14:00 UTC / 10:00 EDT / 07:00 PT.

If you run PHP anywhere in your stack, please stay tuned for workarounds and patches. Be prepared to take action.

We are working with the PHP Foundation and security comunity to coordinate the release of patches and further information. We are working to release Aikido Images that patch the vulnerabilities without requiring extensive updates.

The PHP security team published an advance notice on October 20 after information about the vulnerabilities leaked ahead of the planned disclosure date. Independent researchers confirmed the flaws were real, and the PHP team moved the release up to October 21. The vulnerabilities are continuing to circulate.

Open sources have identified the exploitable behaviour outside of the embargo. and threat actors are more likely to attempt exploitation before patches become available. Cloudflare says exploitation has started.

Configuration mitigations that were reported as workarounds do not work.

We’re holding back exploitation details while systems are still being patched. More information will be made publicly available tomorrow with the patches, or earlier should details of either vulnerability become public, or should evidence of active exploitation appear. See the php site for more information.

https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell

4.7/5

Tired of false positives?
 Try Aikido like 100k others.

Start Now

Get a personalized walkthrough

Trusted by 100k+ teams

October 8, 2026

•

Vulnerabilities & Threats

tensorlake NPM package compromised with Shai Hulud worm

malicious code detected in tensorlake 0.5.144

September 23, 2026

•

Vulnerabilities & Threats

Novel supplychain.local Go worm appears

"supplychain.local": malicious code found in MemTensor's npm plugin (0.1.21, 0.1.23) and PyPI's MemoryOS (2.0.34).

September 22, 2026

•

Vulnerabilities & Threats

Graphalgo campaign spreads to Terraform providers and Go Modules

Aikido found Graphalgo-linked Go malware in Terraform providers and Go Modules, using targeted triggers, Slack, and blockchain C2.

Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.