Critical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2)

What it is

PHP2Shell is the informal name for CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), two flaws in the PHP core runtime. Orca says they allow unauthenticated remote code execution at the runtime level, before application code runs. Specially crafted requests to any PHP-powered web server are enough. The page gives no further mechanism.

Preconditions / Affected

• PHP core runtime, possibly from 5.4 onward. The page marks this range as unconfirmed.
• Patches are scheduled only for branches 8.2, 8.3, 8.4 and 8.5, with an emergency release set for 21 October at 14:00 UTC.
• PHP 8.1, 8.0, 7.x and 5.x are end-of-life and get no official fix.
• An analysis counted about 884,000 internet-facing hosts on PHP 8.1 or older. That is 59% of roughly 1.5 million hosts that report a version. Another 740,000 hosts report PHP without a version number, so their status is unknown.
• WordPress, Laravel, Symfony, Drupal and Magento are named as running on affected branches, mainly when internet-facing.

What to do

• On 8.2 to 8.5, upgrade to the patched release as soon as it is available. The 14:00 UTC release time on 21 October has passed as of this writing, so check whether it has shipped.
• On end-of-life versions, move to 8.2 or later, or ask the hosting provider about a backported fix.
• As an interim measure, CERT-EU advisory 2026-018 recommends putting internet-facing PHP applications behind a VPN or WAF.
• Inventory PHP versions on internet-facing hosts first, including those that do not report a version.

Caveats

• At the time of writing there was no public proof-of-concept and no confirmed exploitation in the wild.
• watchTowr reproduced CVE-2026-109618. A screenshot of an exploit tool credited to Calif.IO has leaked.
• Sansec expects mass exploitation within 15 minutes of the patch release, because attackers can reverse-engineer the fix.
• The page does not describe CVE-2026-109619 separately or give any detection guidance. Its remediation section partly promotes Orca's asset inventory.