PHP2Shell - CVE-2026-109618 & CVE-2026-109619

The Threat

On October 20th, the PHP Group announced an upcoming emergency security release to address two critical vulnerabilities impacting PHP, each rated CVSS 9.2. PHP has stated that technical details and patches will be released on October 21st at 14:00 UTC.

Various organizations have stated that the vulnerabilities are CVE-2026-109618 and CVE-2026-109619; they are colloquially referred to as "PHP2Shell". The flaws are reported to be Remote Code Execution (RCE) vulnerabilities that would allow an attacker to execute arbitrary code on servers running PHP. The vulnerabilities reportedly impact PHP versions 5, 6, 7, and 8.

eSentire is aware of unverified claims of Proof-of-Concept (PoC) exploit code for the vulnerabilities and exploitation in the wild. As information continues to emerge regarding PHP2Shell, eSentire is prioritizing detection engineering and threat hunting.

What we're doing about it

• eSentire's Threat Response Unit has deployed detections in MDR for Network
  • MDR for Endpoint detections are under review
  • Current detections are based on publicly available information at time of writing, and will be improved post-disclosure
• eSentire's Managed Vulnerability Service (MVS) will add relevant plugins as they become available
• eSentire customers can employ the Vulnerabilities and Inferred Vulnerabilities pages in Atlas Portal to search for potentially vulnerable assets
• eSentire's Threat Response Unit (TRU) is tracking this topic for additional information and detection opportunities

What you should do about it

• Identify PHP installations within the environment, including web servers, vendor appliances, Windows software bundling php.exe or php-cgi.exe, control panels, and CMS platforms
  • VirusTotal and NCSC-NL released guidance on identifying vulnerable devices
• Apply security patches for CVE-2026-109618 and CVE-2026-109619 as soon as they are made available
• Isolate End-of-Life PHP instances, and replace with maintained alternatives
• If compromise is suspected, isolate the server, preserve web server and PHP logs, and review for unusual activity and signs of compromise

Additional information

There are various conflicting claims relating to CVE-2026-109618 and CVE-2026-109619. Security researchers from Aikido have recommended organizations review potentially impacted devices for "web shells, unexpected files, new admin users, unusual outbound connections and modified PHP files", going back to at least June 2026. This suggests that PHP2Shell may have been exploited as a zero-day for multiple months prior to disclosure. This claim has not been verified at the time of writing and PHP has not reported exploitation.

Due to the scope of impacted devices and the impact of exploitation, eSentire assesses that exploitation of PHP2Shell is imminent, if it has not already occurred.

References

[1] https://www.php.net/archive/2026.php#2026-10-20-1
[2] https://cybersecuritynews.com/php2shell-vulnerability/
[3] https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell
[4] https://blog.virustotal.com/2026/10/sizing-php-exposure-window-for-cve-2026.html