Update - CVE-2026-109618 & CVE-2026-109619 (PHP2Shell)

The Threat

On October 21st, the PHP Group disclosed two critical vulnerabilities impacting PHP. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are both unauthenticated Remote Code Execution (RCE) flaws with CVSS ratings of 9.2.

eSentire has identified exploitation attempts, using publicly available Proof-of-Concept (PoC) exploit code. As security patches are now available and exploitation attempts are ongoing, it is critical that patches are applied immediately.

What we're doing about it

• eSentire's Threat Response Unit (TRU) is performing endpoint threat hunts across customer environments
  • Impacted customers will be contacted by the eSentire SOC
• TRU has deployed detections in MDR for Network and MDR for Endpoint
  • Current detections are based on publicly available information at time of writing, and will be improved as additional details emerge
• eSentire's Managed Vulnerability Service (MVS) will add relevant plugins as they become available
• eSentire customers can employ the Vulnerabilities and Inferred Vulnerabilities pages in Atlas Portal to search for potentially vulnerable assets
• eSentire's Threat Response Unit (TRU) is tracking this topic for additional information and detection opportunities

What you should do about it

• Identify PHP installations within the environment, including web servers, vendor appliances, Windows software bundling php.exe or php-cgi.exe, control panels, and CMS platforms
  • VirusTotal and NCSC-NL released guidance on identifying vulnerable devices
• Apply security patches for CVE-2026-109618 and CVE-2026-109619
  • Fixed Versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12
• If patching is not immediately possible, apply the temporary mitigations provided by the PHP Group
• Isolate End-of-Life PHP instances, and replace with maintained alternatives
• If compromise is suspected, isolate the server, preserve web server and PHP logs, and review for unusual activity and signs of compromise

Additional information

On October 20th, the PHP Group confirmed that vulnerabilities would be disclosed with security patches. As of the morning of October 21st, CVE details were publicly released along with security patches. The vulnerabilities were first identified by researchers from WIZ in August 2026, who reported the flaws to PHP.

CVE-2026-109618 RCE via OOM corruption: out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

CVE-2026-109619 RCE via stale global state: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

Security researchers from watchTowr identified exploitation of the vulnerabilities in their honeypot infrastructure, starting on October 21st. Cloudflare has also confirmed exploitation observations and released Web Application Firewall (WAF) protections.

The eSentire Threat Intelligence team assesses with high confidence that widespread exploitation of these vulnerabilities is imminent. Due to the widespread use of PHP and the severity of the flaws, they will be highly attractive for threat actors.

* Versions 8.1 and older are End-of-Life and no longer receive updates.

References:

[1] https://www.php.net/archive/2026.php#2026-10-21-5
[2] https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
[3] https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
[4] https://blog.virustotal.com/2026/10/sizing-php-exposure-window-for-cve-2026.html
[5] https://github.com/NCSC-NL/php2shell#:~:text=Repository%20contents-,Directory,-Purpose
[6] https://www.php.net/index.php#2026-10-20-1:~:text=If%20you%20cannot%20update%20immediately%3A
[7] https://www.wiz.io/blog/php2shell-php-rce
[8] https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
[9] https://blog.cloudflare.com/php-vulnerabilities-waf-protection