PHP2Shell: What We Know About CVE-2026-109618 and CVE-2026-109619, and What to Do Today

Wed, 21 Oct 2026 10:45:37 +0000

On October 20, two critical vulnerabilities in PHP core leaked a day before their planned disclosure. They’re tracked as CVE-2026-109618 and CVE-2026-109619, and the exploit tool that leaked with them has a name built for headlines: PHP2Shell.

This one is different from the usual CMS plugin bug. The flaws sit in the interpreter, not in WordPress, Laravel, or your own code. If a server runs PHP, it’s in scope until proven otherwise.

Remote Code Execution on CybersecurityOS

PHP2Shell: What We Know About CVE-2026-109618 and CVE-2026-109619, and What to Do Today