- The flaws allow unauthenticated remote code execution in PHP installations serving web requests.
- CISA had not observed exploitation when it published its alert.
- CISA said CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities requiring immediate patching.
The vulnerabilities allow unauthenticated remote code execution and affect all PHP installations serving web requests. CyberScoop reported that researchers described them as flaws that could let an attacker run code on a server and potentially take control of it. Hackread reported that access could expose application files and credentials available to the web-request process.
CISA had not observed exploitation when it published its alert, but said the vulnerabilities pose a risk if left unpatched. CyberScoop reported that PHP runs on 70–80% of websites whose server-side language is known, while CISA said PHP may be a component of other software and may not be directly observable.
On this page
PHP mod_php deployment carries the highest risk
Hackread reported that PHP maintainers consider Apache mod_php the highest-risk deployment because the attack works before the website’s own code begins running. Exploitation does not automatically grant administrator privileges over the entire server, but it can expose resources available to the web-request process.
No confirmed live exploitation reported
Huntress said it had not observed or independently confirmed successful in-the-wild exploitation on live customer systems.
CyberScoop reported that the flaws received a 9.2 rating on the CVSS v4.0 severity scale, which tops out at 10. It also reported that Calif discovered the vulnerability using OpenAI’s cybersecurity-focused AI model GPT-5.6 Sol.
CISA lists offline and monitoring measures
CISA urged organizations to identify and inventory systems running any PHP version because PHP can be a component of other software and its prevalence may not be directly observable.
Hackread reported that temporary controls include disabling session upload progress and, on PHP 8.5, disabling fatal-error backtraces, followed by restarting every PHP worker. PHP maintainers warned that no generic configuration change covers every attack route and that complete fixes remain necessary.
CISA said defenders should monitor for PHP worker processes launching shells or downloading tools. It also said a web application firewall may provide some protection until systems are updated or patched.
OpenAI said frontier AI found the vulnerabilities before attackers did, giving maintainers and security providers time to prepare fixes and protections before disclosure. CyberScoop reported that the groups involved spent two months preparing the technical fix and public disclosure.
What to do now
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- Take PHP-based systems offline until they can be patched or updated if you cannot update immediately or continue to use PHP 8.1 or earlier unsupported versions.
- Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.
FAQ
What are the php2shell PHP vulnerabilities?
They are CVE-2026-109618 and CVE-2026-109619, critical vulnerabilities that allow unauthenticated remote code execution in PHP installations serving web requests.
Which PHP versions are affected by php2shell?
CISA said all PHP installations serving web requests are affected. Wired reported that the exposure extends back to PHP 5, released in July 2004.
Has php2shell been exploited?
CISA had not observed exploitation when it published its alert. Huntress said it had not independently confirmed successful exploitation on live customer systems.
How do I fix CVE-2026-109618 and CVE-2026-109619?
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Organizations using unsupported PHP 8.1 or earlier should take PHP-based systems offline until they can be patched or updated.
What is remote code execution in this PHP alert?
CISA said the flaws allow unauthenticated remote code execution. CyberScoop reported that researchers said an attacker could run code on a server and potentially take control of it, while Hackread reported that access could expose application files and credentials available to the web-request process.
Sources
- Critical Vulnerabilities in PHP Require Immediate Patching, CISAPrimary
- ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire, Wired
- PHP releases emergency fixes for 2 critical vulnerabilities, CyberScoop
- PHP Releases Emergency Fixes for Critical PHP2Shell Vulnerabilities, Hackread
How we checked this story
| Claim | Source | Status |
|---|---|---|
| CISA said CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities requiring immediate patching. | CISA | Confirmed |
| CISA said the vulnerabilities, known as php2shell, allow unauthenticated remote code execution and affect all PHP installations serving web requests. | CISA | Confirmed |
| CISA had not observed exploitation when it published its alert but said the vulnerabilities pose a risk if left unpatched. | CISA | Confirmed |
| CISA urged organizations to identify and inventory systems running any PHP version because PHP may be a component of other software. | CISA | Confirmed |
| CISA said a web application firewall may provide some protection until systems are updated or patched. | CISA | Confirmed |
| Wired reported that PHP emergency security updates were released on Wednesday to fix critical flaws that could enable dangerous remote control of victim systems. | Wired | Attributed |
| Wired reported that the vulnerabilities affect PHP installations serving web requests going back to version 5, released in July 2004. | Wired | Attributed |
| CyberScoop reported that both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale. | CyberScoop | Attributed |
| CyberScoop reported that researchers described the vulnerabilities as remote code execution flaws that could let attackers run code and potentially take control of a server. | CyberScoop | Attributed |
| CyberScoop reported that Huntress had not observed or independently confirmed successful in-the-wild exploitation on live customer systems. | Huntress, via CyberScoop | Attributed |
| CyberScoop reported that researchers estimated more than 1.3 million internet-exposed hosts could be vulnerable. | CyberScoop | Attributed |
| CyberScoop reported that PHP runs on 70–80% of websites whose server-side language is known. | CyberScoop | Attributed |
| CyberScoop reported that Calif discovered the vulnerability using OpenAI’s cybersecurity-focused AI model GPT-5.6 Sol. | CyberScoop | Attributed |
| CyberScoop reported that OpenAI, PHP maintainers, researchers, and security providers spent two months collaborating on a technical fix and disclosure preparation. | CyberScoop | Attributed |
| OpenAI said frontier AI found the vulnerabilities before attackers did, allowing maintainers and security providers to prepare fixes and protections. | OpenAI, via CyberScoop | Attributed |
| Hackread reported that the vulnerabilities affect PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed installations serving web requests. | Hackread | Attributed |
| Hackread reported that PHP maintainers consider Apache mod_php the highest-risk deployment because an attack works before website code begins running. | Hackread | Attributed |
| Hackread reported that exploitation grants the permissions of the web-request process and can expose application files and credentials without automatically granting server-wide administrator privileges. | Hackread | Attributed |
| Hackread reported that temporary controls include disabling session upload progress and fatal-error backtraces, followed by restarting every PHP worker. | Hackread | Attributed |
| Hackread reported that PHP maintainers warned no generic configuration change covers every attack route and complete fixes remain necessary. | Hackread | Attributed |
| CISA published its report on Oct 21, 2026. | CISA | Confirmed |
Could not verify
- Whether the vulnerabilities have been exploited in the wild is not established.
- How many PHP systems are actually affected is not established.
- Whether the two vulnerabilities share a single underlying technical cause is not established.
- Whether the reported reconnaissance activity will lead to successful exploitation is not established.
Related stories
Vulns & PatchesPHP emergency patches fix PHP2Shell flaws that could run code
Vulns & PatchesOpenAI launches Patch the Planet to address critical open-source flaws
Vulns & PatchesPHP 8.x updates fix two critical RCE flaws after disclosure leak