Skip to content

Back to the catalog

Critical vulnerabilities in PHP (PHP2SHELL)
aikido.devadvisory

Critical vulnerabilities in PHP (PHP2SHELL)

PHP2SHELL is Aikido Security's advance notice of two critical remote code execution flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2, with all versions treated as affected. The PHP security team will release fixes at 14:00 UTC on 21 October 2026, a day early after details leaked on 20 October. The post withholds exploitation details and workarounds.

TL;DR Warns of two critical PHP remote code execution CVEs, with patches due 21 October 2026 after an early leak.
Open original ↗

Organisations named here

  • PHP Foundation

CVEs named here

  • CVE-2026-109618
  • CVE-2026-109619

Technologies named here

  • PHP
  • CVSS

Threat actors named here

  • PHP2Shell

Related in AppSec