By security.com
Publication Date:
Key findings
- The PHP project released fixes on October 21, 2026, for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both carry a Common Vulnerability Scoring System (CVSS) v4.0 score of 9.2 (Critical Severity).
- Both flaws are use-after-free conditions in the PHP runtime. An unauthenticated attacker can send crafted web requests that lead to remote code execution (RCE), allowing them to take over vulnerable servers
- Any PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache with mod_php carries the highest risk.
- Technical details leaked on October 20, before patches were available, and public proof-of-concept code has been reported.
- Symantec and Carbon Black products protect customers, and additional protections are in development. Our Protection Bulletin is updated as new protection information becomes available.
Overview
Two critical flaws in PHP, one of…
