PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

What it is

PHP2Shell is the public name for two critical PHP vulnerabilities, reportedly CVE-2026-109618 and CVE-2026-109619, each scored CVSS 9.2 and described as leading to remote code execution. PHP announced on Tuesday 20 October 2026 that patches are planned for Wednesday 21 October 2026 at 14:00 UTC (10:00 am ET). Details leaked before that coordinated disclosure.

Preconditions / Affected

• Public reporting says all PHP versions from PHP 5 onwards are affected. The page does not name a specific fixed version.
• The "unauthenticated" claim is an inference. CERT-EU says that, based on the CVSS scores, both flaws could be exploited without authentication.
• The leaked details give no root cause, affected component or attack path. One report suggests CVE-2026-109618 is a use-after-free bug.

What to do

• Prepare to upgrade as soon as the release appears. PHP's statement: "All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available."
• Do not rely on the 14:00 UTC time. PHP said fixes may ship earlier if technical details are published or in-the-wild exploitation emerges, and details have already leaked. Check for a release ahead of schedule.
• Sansec expects mass exploitation to start within 15 minutes of the patch release, so the window between release and patching is the risk. Have builds, images and rollout steps ready beforehand.

Caveats

• watchTowr says it reproduced CVE-2026-109618 and confirms the flaws are real. It is withholding technical details until patches are out. The page does not say whether CVE-2026-109619 was reproduced.
• watchTowr and Huntress say they have not seen either flaw exploited in the wild. The 15-minute figure is Sansec's forecast, not an observation.
• The page gives no mitigation or workaround other than patching, and no detection guidance.