PHP2Shell - All You Need to Know About CVE-2026-109618 and CVE-2026-109619

Summary by Cyber Security News21 Oct 2026, 02:00 CET

About this summary. This is a short excerpt from the description that JFrog Security Research published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/

Two critical Remote Code Execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are scheduled for disclosure before a fix is available to organizations. JFrog is closely monitoring these vulnerabilities and will share information here to help security teams identify exposed systems and prepare to patch. On October 20, the [PHP](https://www.php.net/) security team announced an upcoming security release scheduled for October 21 at 14:00 UTC.

Read the full article at JFrog Security Research →

Source attribution: headline and facts are from JFrog Security Research (research.jfrog.com). Summary method: excerpt of the source description. See our source attribution policy.