Book a Demo

Another Day, Another Core RCE: Welcome to PHP2Shell (CVE-2026-109618 & CVE-2026-109619)

PhishFort Team
PhishFort Team
Published • 4 min read
Another Day, Another Core RCE: Welcome to PHP2Shell (CVE-2026-109618 & CVE-2026-109619)

Because the universe apparently loves chaos, we’ve just been handed a pair of fresh, farm-to-table remote code execution vulnerabilities in PHP core. Say hello to CVE-2026-109618 and CVE-2026-109619, affectionately (and appropriately) dubbed PHP2Shell.

Early leaks had internet-watchers salivating over a spicy CVSS 10.0 rating, though the PHP team officially clocked them at a cool 9.2 Critical. Potato, potato: when you’re looking at unauthenticated RCE in the engine driving a massive chunk of the global web, the exact decimal point hardly matters. Whether it’s WordPress, Drupal, Magento, Laravel, or that crusty custom monolith rotting in your DMZ, everyone’s favorite digital duct tape is sweating.

How We Got Here

The timeline on this one has been an absolute mess:

  • October 20, 2026: Details leak early across Hacker News and security circles (shoutout to watchTowr’s analysis and CERT-EU Advisory 2026-018 tracking the fallout), blowing up an embargo originally slated for later in the week.
  • The Pivot: The PHP team hit fast-forward on their security release, moving the official release drop to October 21, 2026, at 14:00 UTC (keep an eye on the official PHP Announcements page).
  • The Panic: But even twelve hours can be a long time on the internet. Security teams at places like Sansec and Huntress scrambled to issue warnings while researchers coordinated patching windows before public diffs turn every script kiddie into a seasoned exploit developer.

The Real Problem: End-of-Life Purgatory

The php.net notice of 20 October 2026 announcing the critical security release scheduled for 21 October 2026 at 14:00 UTC

The php.net advance notice: two critical vulnerabilities, both rated CVSS v4.0 9.2, release scheduled for 21 October 2026 at 14:00 UTC

Sure, the patches are rolling out for currently supported PHP 8 branches today. But let’s look at the elephant in the server room: the sheer volume of legacy infrastructure running on unsupported versions.

If your enterprise, client, or staging environment is still using on PHP 5 or 7 (or early 8.x branches that have aged out of support), official patches aren’t coming, at least not today.

Note: While entries for these CVEs exist on the NIST National Vulnerability Database (NVD), detailed analysis and scoring will remain in reserved status until vendors fully publish their advisories.

What to Do Right Now

  1. Inventory Everything: Dust off your asset management tools. Do you actually know where every single PHP binary, container image, and shared hosting node lives?
  2. Grab the Patches: As soon as the official release drops and the diffs go live, expect automated scanners to saturate ports within the hour. Get your staging pipelines ready to upgrade immediately.
  3. Isolate the Undead: Anything stuck on EOL versions needs to be firewalled off, micro-segmented, or taken offline and potentially decommissioned entirely.

Why This Matters for Brand Protection

A shell on someone else’s PHP server is a free phishing host. Compromised but otherwise legitimate websites already make up a large share of the infrastructure behind phishing pages, because they come with a clean domain reputation, valid TLS, and an owner who has no idea anything is wrong. A core RCE this broad means a fresh wave of hijacked WordPress, Magento, and Drupal sites hosting fake login pages for banks, exchanges, and SaaS brands in the coming weeks.

If your brand’s phishing pages start showing up on random small business domains rather than freshly registered lookalikes, this is why. Takedowns on compromised sites work differently from takedowns on malicious domain registrations: the goal is to get the owner or host to clean the site, not to kill the domain. We cover that process in our guide to compromised website takedowns.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the nickname given to CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated remote code execution vulnerabilities in PHP core. The PHP security team rates both 9.2 Critical under CVSS v4.0, and early leaked reports described them as 10.0.

Which PHP versions get a fix?

The PHP team is shipping fixes for the currently supported PHP 8 branches in its security release on 21 October 2026 at 14:00 UTC. PHP 5, PHP 7, and early PHP 8.x branches that have reached end of life will not receive an official patch.

What should I do if I cannot upgrade PHP immediately?

Isolate the affected hosts behind an up-to-date Web Application Firewall (WAF) or network segmentation, restrict what can reach them from the internet, and watch the logs for unexpected shells or new files. Then plan the upgrade or retirement of anything on an end-of-life version, because no vendor patch is coming for those.

How does a PHP vulnerability affect phishing and brand abuse?

Attackers use remote code execution bugs to take over legitimate websites and host phishing pages on them. Those pages inherit the site’s clean reputation, so they get past filters more easily and need a different takedown approach than a purpose-registered phishing domain.

Further Reading

How PhishFort Protects Brands From Phishing

PhishFort finds the phishing sites, fake apps and impersonation accounts that use your brand and takes them down, with evidence for every case.

Explore PhishFort Takedowns

Blog

Related posts