Keep Calm and Patch PHP2Shell October 21, 2026 Justin Timothy With contributions by the GuidePoint Security GRIT team BLOG 10 min. How to Respond to CVE-2026-109618 and CVE-2026-109619 *Note: This is an actively developing situation and the information from this blog is accurate as of writing. Please refer to PHP’s official guidance for any newly released information and additional patching and mitigation recommendations.
Keep Calm, and Patch PHP2Shell
About this summary. This is a short excerpt from the description that GuidePoint Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.guidepointsecurity.com/blog/how-to-patch-php2shell/
Source attribution: headline and facts are from GuidePoint Security (guidepointsecurity.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP…
CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks
IntroductionOn October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,”…
PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now
The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow…
php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit
Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and…
Introducing the Cloudflare PHP Capture the Flag challenge
Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised, creating the possibility of forged…
PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet
PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two…