PHP2Shell Leaks Expose Critical RCE Flaws Ahead of October Patch Release
Leaked details of two critical PHP vulnerabilities have triggered urgent patching warnings from the project maintainers and security firms.
Key points
- Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, were leaked online before official patches.
- The vulnerabilities allow unauthenticated remote code execution on servers running PHP 5 or later.
- Patches are scheduled for October 21, 2026, but may be released earlier if exploitation evidence emerges.
Attackers exploiting the leaked PHP2Shell vulnerabilities gain the ability to execute arbitrary code on vulnerable servers without needing valid login credentials. This unauthenticated remote code execution capability allows threat actors to take full control of the affected systems. According to SecurityWeek, the flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Sansec predicts that mass exploitation will likely start within 15 minutes of the patch release.
In plain English
The PHP project has issued an urgent warning regarding two critical security defects that have been exposed publicly. These bugs allow attackers to run commands on a server remotely, bypassing standard authentication checks entirely. The vulnerabilities affect a wide range of software versions, specifically all releases of PHP from version 5 onwards. Because the technical details have been leaked ahead of the coordinated disclosure schedule, defenders are under pressure to prepare for immediate remediation.
View the original post on X
View the original post on X
The background
Details regarding the PHP2Shell flaws were submitted to the r/netsec subreddit by user /u/Wploplin. This premature disclosure occurred before the official patch release date. The PHP team stated that fixes for both issues, which carry a CVSS score of 9.2, are planned for Wednesday, October 21, 2026, at 14:00 UTC. The maintainers emphasized that users should prepare their environments now to upgrade as soon as the release is available.
What changes now
Security firms are monitoring the situation closely for signs of active exploitation. WatchTowr, a preemptive exposure management firm, confirmed it could reproduce CVE-2026-109618 but withheld technical specifics. While WatchTowr and Huntress report no current in-the-wild exploitation, Sansec predicts mass exploitation could start within 15 minutes of the patch release. CERT-EU notes the CVSS scores indicate unauthenticated exploitation is possible.
What made it possible
Remote code execution vulnerabilities typically arise from improper input validation or memory management errors within server-side applications. In this class of incident, the weakness allows an attacker to inject malicious commands that the server processes as legitimate instructions. This technique serves the initial access stage of an intrusion, bypassing perimeter defenses by exploiting the application logic itself. Teams usually monitor for unusual outbound connections or new shell processes as indicators of compromise.
Background: Indicators of compromise
Indicators of compromise examples include malicious IP addresses, domain names, and file hashes. These artifacts signal a breach. You use them to detect active intrusions. However, static indicators fail against fileless malware. You must combine them with behavioral monitoring to reduce attacker dwell time and catch threats that evade signature-based defenses.
Read the full guide: Indicators of Compromise Examples and How to Use Them
What to do and how to stay safe: PHP
- Verify which PHP versions are running on your infrastructure and confirm if they fall within the affected range of PHP 5 and later.
- Prepare your update procedures and test environments to ensure you can deploy the official patches immediately upon release.
- Monitor server logs and network traffic for unusual activity that may indicate unauthorized access or command execution attempts.
- Review access controls and network segmentation to limit the potential impact if a server is compromised before patching.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When will the patches for CVE-2026-109618 and CVE-2026-109619 be released?
Patches are scheduled for October 21, 2026, at 14:00 UTC, but may be released earlier if exploitation evidence emerges.
Which PHP versions are affected by these vulnerabilities?
All PHP versions from PHP 5 onwards are reportedly affected by the PHP2Shell flaws.
Are these vulnerabilities currently being exploited in the wild?
WatchTowr and Huntress say they have not seen evidence of in-the-wild exploitation yet.
