CVEs: CVE-2026-109618, CVE-2026-109619
Severity: Critical
Executive Summary
Two critical vulnerabilities in the PHP runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell, could allow unauthenticated attackers to execute arbitrary code on vulnerable web servers, including systems hosting WordPress, Drupal, and Joomla applications. Security researchers have reported exploitation attempts surrounding the October 21 emergency security release, including activity observed before public disclosure, while VulnCheck documented automated scanning and an unsuccessful attempt to deploy a web shell through PHP session-handling functionality. With millions of internet-facing PHP deployments potentially exposed and a substantial proportion running unsupported versions, organizations face an urgent need to remediate vulnerable systems and investigate suspicious activity preceding the security release.
