Live › vulnerability › CVE-2026-109619
Go to dashboardPHP keeps stale memory state from one request and can reuse it in a later request, which lets an attacker run code on the server. The sources report public proof-of-concept exploits and exploitation in the wild, and they list fixed releases for each supported PHP branch.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any server running PHP from 5.4.0 up to the fixed releases, whether behind Apache mod_php, php-fpm with nginx or Apache, or in a container image. The sources list PAN-OS and Siemens RUGGEDCOM entries in the product data without clear version detail, so verify those separately before ruling them in or out.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| php | vendor | >= 5.4.0, < 8.2.35 | 8.2.35 |
| php | vendor | >= 8.3.0, < 8.3.36 | 8.3.36 |
| php | vendor | >= 8.4.0, < 8.4.27 | 8.4.27 |
| php | vendor | >= 8.5.0, < 8.5.12 | 8.5.12 |
| siemens ruggedcom ape1808 firmware | vendor | – | – |
| paloaltonetworks pan-os | vendor | >= 10.2.0, < 10.2.7 | 10.2.7 |
| paloaltonetworks pan-os | vendor | = 10.2.7 | – |
| paloaltonetworks pan-os | vendor | = 10.2.8 | – |
| paloaltonetworks pan-os | vendor | = 10.2.9 | – |
| paloaltonetworks pan-os | vendor | = 10.2.10 | – |
| paloaltonetworks pan-os | vendor | = 10.2.11 | – |
| paloaltonetworks pan-os | vendor | = 10.2.12 | – |
| paloaltonetworks pan-os | vendor | = 10.2.13 | – |
| paloaltonetworks pan-os | vendor | = 10.2.14 | – |
| paloaltonetworks pan-os | vendor | = 10.2.15 | – |
| paloaltonetworks pan-os | vendor | = 10.2.16 | – |
| paloaltonetworks pan-os | vendor | = 10.2.17 | – |
| paloaltonetworks pan-os | vendor | = 10.2.18 | – |
| paloaltonetworks pan-os | vendor | >= 11.1.0, < 11.1.4 | 11.1.4 |
| paloaltonetworks pan-os | vendor | = 11.1.4 | – |
| paloaltonetworks pan-os | vendor | = 11.1.5 | – |
| paloaltonetworks pan-os | vendor | = 11.1.6 | – |
| paloaltonetworks pan-os | vendor | = 11.1.7 | – |
| paloaltonetworks pan-os | vendor | = 11.1.8 | – |
| paloaltonetworks pan-os | vendor | = 11.1.9 | – |
| paloaltonetworks pan-os | vendor | = 11.1.10 | – |
| paloaltonetworks pan-os | vendor | = 11.1.11 | – |
| paloaltonetworks pan-os | vendor | = 11.1.12 | – |
| paloaltonetworks pan-os | vendor | = 11.1.13 | – |
| paloaltonetworks pan-os | vendor | = 11.1.14 | – |
| paloaltonetworks pan-os | vendor | = 11.1.15 | – |
| paloaltonetworks pan-os | vendor | = 11.1.16 | – |
| paloaltonetworks pan-os | vendor | >= 11.2.0, < 11.2.4 | 11.2.4 |
| paloaltonetworks pan-os | vendor | = 11.2.4 | – |
| paloaltonetworks pan-os | vendor | = 11.2.5 | – |
| paloaltonetworks pan-os | vendor | = 11.2.6 | – |
| paloaltonetworks pan-os | vendor | = 11.2.7 | – |
| paloaltonetworks pan-os | vendor | = 11.2.8 | – |
| paloaltonetworks pan-os | vendor | = 11.2.9 | – |
| paloaltonetworks pan-os | vendor | = 11.2.10 | – |
| php | vendor | >= 8.2.0, < 8.2.35 | 8.2.35 |
| php | vendor | >= 5.4.0, <= 8.1.x (end of life) | – |
php -v on each host, container and PHP-FPM image and compare the version with the fixed releases below.8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or later) on the branch you run.The fix above is the answer. These hold the line until you can deploy it, and are the only option on lines that get no fix.
What vendors did on their customers’ behalf. Holds only for traffic through them; patching is still the fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@gdb · X3611 likes · 332 reposts2026-10-21 14:58“Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative. https://t.co/rBsz7lrlwo”
View on X
@calif_io · X3071 likes · 404 reposts2026-10-21 14:31“Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: https://t.co/mE27XnmJlM His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review,”
View on X
@calif_io · X1164 likes · 140 reposts2026-10-21 14:49“Do you know who illustrated the comic on https://t.co/KEUVez9rnN? Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax. This artist-hacker couple has the best story, stay tuned!”
View on X
@calif_io · X757 likes · 61 reposts2026-10-23 10:27“Just in case it wasn’t clear: we popped the iPhone Duo on release day, adding a much needed feature, inspired by the php2shell hacker @lcfr_hax! What else there to hack? Wrong answers only. https://t.co/ktYFhrH7lC”
View on X
@wiz_io · X428 likes · 121 reposts2026-10-21 13:32“🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet. https://t.co/B7yEQuhnoS”
View on X
@Hacker0x01 · X277 likes · 21 reposts2026-10-21 17:12“🚨 Fixes are out for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Security researchers: If you find affected assets within program scope, submit validated findings with clear evidence and impact. Details: https://t.co/Z5DUmpGUNu”
View on X
@watchtowrcyber · X154 likes · 31 reposts2026-10-21 15:07“Congratulations to the team at @calif_io (specifically @lcfr_hax) for the discovery of PHP2Shell. We've now shared further information aimed at helping end users, but credit for this amazing work goes to @calif_io and @lcfr_hax https://t.co/4ibdwkmvZb”
View on X
@wiz_io · X53 likes · 15 reposts2026-10-21 15:00“AI tools helped find one of the most severe online bugs ever #php2shell In our latest episode of Crying Out Cloud, Amitai Cohen sits down with @sagitz_ (Wiz Research) and Thai Duong (@calif_io) to unpack the massive PHP2Shell vulnerability https://t.co/n4pfiXjDNC”
View on X
@sans_isc · X30 likes · 19 reposts2026-10-21 13:08“Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) https://t.co/BgXfR1KYW1 . Infocon yellow.”
View on X
@watchtowrcyber · X49 likes · 9 reposts2026-10-23 10:55“Watch now: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploitation attempts are already underway. Jake Knott, Head of Threat Intelligence at watchTowr, shares what we're seeing, what's being attempted, and what to do now in our latest Threat Briefing. https://t.co/mMuYBrwPnd”
View on X
@watchtowrcyber · X59 likes · 4 reposts2026-10-20 18:35“yes, we mean CVE-2026-109618 and CVE-2026-109619”
View on X
@xbow · X44 likes · 6 reposts2026-10-21 20:24“PHP2Shell: just another critical vulnerability but on a much faster clock... AI didn’t make PHP vulnerable. It changed the economics of finding and exploiting the bugs already there. @fede_k breaks down what happened and the shrinking window for defenders:”
View on X
@wiz_io · X14 likes · 4 reposts2026-10-21 13:32“PHP2Shell marks an inflection point: AI changes the practical exploitability of longstanding vulnerabilities. Frontier models (Wiz Atlas, GPT-5.6-Sol, and Gemini 4 Argon) were used to hunt down and chain these 10-year-old flaws in under a week, with Gemini 4 making a particularly”
View on X
@sans_isc · X6 likes · 1 reposts2026-10-22 02:00“SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More https://t.co/knzRtA2cLX https://t.co/pufBWe95hJ”
View on X
@sans_isc · X1 likes · 2 reposts2026-10-23 10:25“SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked https://t.co/03fbCidRZE https://t.co/PwLmDFvKyC”
View on X
@xbow · X5 likes · 0 reposts2026-10-22 17:51“PHP2Shell just showed us how quickly defenders need to act. What should they be most worried about? 🫨”
View on X
@sans_isc · X0 likes · 1 reposts2026-10-23 20:06“(Reliable)? php2shell exploitability https://t.co/D8svpFnNqg https://t.co/cvK5ziwwB3”
View on X
@eastdakota · X22562 likes · 3266 reposts2026-10-22 01:25“Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
View on X
@CloudflareDev · X4203 likes · 485 reposts2026-10-21 20:29“⚠️ Vulnerability alert: php2shell Unpatched sites running PHP 5.4 or later are at risk of remote code execution, data exposure, and crashes. If your site’s web traffic is proxied through Cloudflare, we deployed protections before official public disclosure. Check the blog post https://t.co/3xLjlkUX8u”
View on X
@vxunderground · X2600 likes · 219 reposts2026-10-22 01:52“Today silly shenanigans: - PHP2shell, leak, bad stuff - Something about Railway? - The number 4 is a valid cert - NodeJS and something about broccoli? - LiteLLM supply chain attack - GitLab CVSS 10 - OpenCode leaking API keys What does this all mean? Idk https://t.co/dr91Zv7doj”
View on X
@rez0__ · X2700 likes · 76 reposts2026-10-22 13:33“My non-hacking buddy asked me how much the person who found the php2shell made. Then he made a good observation: Hack a small company, make a little. Hack a big company, make a lot. Hack 70% of the world, make nothing.”
View on X
@vxunderground · X1822 likes · 60 reposts2026-10-23 07:59“Lots of arguments online surrounding who truly discovered PHP2Shell, who gets the clout, etc. I am the person who found. I found it in like 2013, or something, whatever. Trust me, bro. I'm hardcore and 1337. Now give me lots of monies and clout. Don't be a hater https://t.co/9DpsAQC4ry”
View on X
Hacker News · Hacker News267 points2026-10-22 11:50“Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/”
View on Hacker News
@rauchg · X450 likes · 17 reposts2026-10-21 19:29“It was inspiring to watch the behind-the-scenes¹ of the industry coming together, weeks in advance, to protect the world's infrastructure and mitigate php2shell. We deployed Vercel WAF mitigations that have already successfully prevented attempts on PHP origins. Assume more https://t.co/h99Nh8pCJX”
View on X
@troyhunt · X440 likes · 19 reposts2026-10-22 20:20“Have we seen any documented breaches / exploitation traced back to either PHP2Shell or the eMudhra debacle? Massive headlines this week, what’s the impact so far (other than all the scrambling to patch etc)?”
View on X
@CFchangelog · X315 likes · 51 reposts2026-10-23 19:30“Emergency update to the Cloudflare Managed Ruleset on 2026-10-22 refines metadata for 7 rules targeting CVE-2026-109618 and CVE-2026-109619. Detection logic and block actions remain unchanged. https://t.co/GuwGtO7EVt”
View on X
@craiu · X158 likes · 46 reposts2026-10-21 15:10“Keeping track of all #PHP2Shell things, IOCs, log artifacts, exploitation status, patches, here: https://t.co/w20rTaVxMG”
View on X
Hacker News · Hacker News132 points2026-10-21 14:11“Cloudflare deploys protections against php2shell vulnerability https://blog.cloudflare.com/php-vulnerabilities-waf-protection/”
View on Hacker News
@TheHackersNews · X98 likes · 20 reposts2026-10-23 12:06“The new PHP flaw is separate from the two critical #PHP2Shell bugs patched on October 21. CVE-2026-115560 is NOT fixed by those emergency updates. PHP says exploitation requires an unusual session configuration and considers the risk unlikely in practice. No attacks reported.”
View on X
@TheHackersNews · X63 likes · 13 reposts2026-10-23 12:07“PHP has a one-line mitigation for CVE-2026-115560: session.upload_progress.enabled=0 This disables session upload progress until the fix arrives in a routine release. Already applied this mitigation for CVE-2026-109619? No further action is needed.”
View on X
@craiu · X56 likes · 15 reposts2026-10-23 10:32“A new IP seen trying to exploit #PHP2shell - 85.11.167[.]243”
View on X
@campuscodi.risky.biz · Bluesky18 likes · 9 reposts2026-10-23 10:06“-Supply chain attack lets ransomware group inside 40+ shipping companies -Pentagon builds tech sabotage unit -PHP2Shell exploitation gets underway -GoDaddy revokes 400,000 certs -LiteLLM has another security incident P: risky.biz/RBNEWS624/ N: news.risky.biz/risky-bullet... https://risky.biz/RBNEWS624/ https://news.risky.biz/risky-bulletin-supply-chain-attack-lets-ransomware-group-inside-40-shipping-companies/”
View on Bluesky
@SocketSecurity · X29 likes · 5 reposts2026-10-23 18:19“Good news, everyone! PHP2Shell exploits are a massive fail (so far) 🤞 https://t.co/S2dYcN1dxm”
View on X
@doublepulsar.com · Bluesky20 likes · 2 reposts2026-10-23 10:06“PHP2Shell thread: cyberplace.social/@GossiTheDog... https://cyberplace.social/@GossiTheDog/117474220875882526”
View on Bluesky
@clintgibler · X10 likes · 0 reposts2026-10-23 19:44“📚tl;dr sec 351 😈 PHP2Shell, 🧑🏻💻 Autopatching Skills, 🤖 AWS Pathrunner https://t.co/eTi8ezZKgw”
View on X
Hacker News · Hacker News4 points2026-10-22 13:27“Re: Hours later – No, there is an easy way to exploit this vulnerability https://github.com/cookiengineer/actual-php2shell”
View on Hacker News
Hacker News · Hacker News4 points2026-10-21 16:23“Your Sites Are Protected Against the PHP2Shell Vulnerabilities https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/”
View on Hacker News
Hacker News · Hacker News3 points2026-10-21 09:59“PHP2Shell: Critical Vulnerabilities in PHP https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell”
View on Hacker News
Hacker News · Hacker News3 points2026-10-22 19:00“Php2shell is not exploitable in real production enviroment https://berardinellidaniele.com/posts/php2shell/”
View on Hacker News
Hacker News · Hacker News2 points2026-10-21 13:56“A tale of two PHP remote vulnerabilities https://calif.io/php2shell.x/”
View on Hacker News
Hacker News · Hacker News2 points2026-10-23 05:48“PHP2Shell (CVE-2026-109618) Exploit https://www.exploit-db.com/exploits/52704”
View on Hacker News
Hacker News · Hacker News2 points2026-10-22 13:29“Amazon says PHP2Shell exploitation began 4 days before patches https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/”
View on Hacker News
@CISAgov · X0 likes · 1 reposts2026-10-24 13:21“Update to #PHP2Shell Alert: SIGMA rule helps identify potentially suspicious activity & incorporated partner resources. If your org can't update immediately or uses unsupported PHP 8.1 or earlier versions, take affected PHP-based systems offline until patched or updated. https://t.co/r1GlMILxXU”
View on X
Hacker News · Hacker News1 points2026-10-23 15:51“A small audit script and config notes for the new PHP CVEs https://github.com/mc493/php2shell-enterprise-hardening-cve-2026-109618-109619”
View on Hacker News
Hacker News · Hacker News1 points2026-10-23 01:29“A tale of two PHP remote vulnerabilities https://calif.io/php2shell.x/”
View on Hacker News
Hacker News · Hacker News1 points2026-10-22 18:25“Why governments pulled websites offline over the decades-old PHP language https://www.cnbc.com/2026/10/22/php2shell-vulnerability-what-is-it-and-is-your-data-at-risk.html”
View on Hacker News
Hacker News · Hacker News1 points2026-10-22 12:56“PHP2Shell: Critical PHP Vulnerabilities, What to Do About Them https://www.getastra.com/blog/security-advisory/php2shell-php-vulnerabilities/”
View on Hacker News
Hacker News · Hacker News1 points2026-10-21 22:28“A tale of two PHP remote vulnerabilities https://calif.io/php2shell.x/”
View on Hacker News
Hacker News · Hacker News1 points2026-10-21 14:51“PHP2Shell: Critical PHP RCE Vulnerabilities Explained https://moneo.com.tr/blog/php2shell-critical-php-rce-vulnerabilities-explained”
View on Hacker News
Hacker News · Hacker News1 points2026-10-21 13:41“Simple Proxy to secure your PHP from PHP2Shell vulnerability https://github.com/Qbix/proxy”
View on Hacker News
Hacker News · Hacker News1 points2026-10-21 02:42“PHP2Shell https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities”
View on Hacker News
Hacker News · Hacker News1 points2026-10-23 04:16“PHP2Shell Needs One HTTP Request. OpenNHP Never Lets It Arrive https://opennhp.org/blog/php2shell-attackers-cannot-exploit-what-they-cannot-reach/”
View on Hacker News
Posts are quoted with a link to the original. They are data to us, never instructions.
Patch the Planet: global response coordination as agents uncover critical vulnerabilities | OpenAI
October 21, 2026
Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications. Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet(opens in a new window) initiative, with Wiz also independently discovering and reporting both vulnerabilities. PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure.
For organizations using PHP, the priority now is applying the fixes. We’re sharing a PHP version checker as a Codex skill(opens in a new window) to help operators identify potentially vulnerable PHP versions and, alongside PHP’s and their providers’ guidance, determine which updates apply.
Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory. It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.
To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure.
To help more defenders use these capabilities, we’ve committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services.
As significant as they are, these bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months. Drawing on our experience thus far, we’re sharing a proposed approach, appropriate for the AI era, to responding to critical vulnerabilities in widely used software, and we’re asking the security community to help improve this framework. It brings together our models, security expertise, and maintainers to help turn findings into protection and build a response that can scale as AI capabilities advance.
Getting a fix into use can mean adapting it for older releases, preparing provider mitigations, and updating systems across many organizations. A repeatable process helps those teams act quickly as more vulnerabilities are discovered.
Through Patch the Planet, we contributed security expertise and model access to support the PHP response, and worked with maintainers and research partners to test fixes and prepare guidance. We also helped coordinate with infrastructure providers on protections for affected systems and engaged government cyber agencies to help guidance reach critical organizations. This supported the maintainer-led response and helped other defenders prepare.
For some findings, researchers can work directly with the software’s maintainers to investigate the issue and develop a fix. Others need a wider response because they affect many products or because distributors and service providers need time (which may be in short supply if frontier capabilities are not too far ahead of those that are broadly available) to prepare updates and protections. In those cases, the proposed framework can help maintainers identify who needs to be involved and coordinate the work. The response can involve five stages:
The proposed framework considers an organization’s protective role, including protecting its own systems and customers, the time needed to act, and its ability to handle sensitive information. The same criteria would apply to comparable organizations, with maintainers deciding whom to involve ahead of disclosure.
Each participant receives the information needed to carry out their protective work, from network logs with indicators of compromise to more sensitive working proof-of-concept exploits. Even limited details can reveal a vulnerability, so we weigh the risk of sharing them against the protection they enable.
Teams following this framework would work with maintainers to give defenders time to prepare and reassess the timeline if there’s active exploitation in the wild, a leak, a revealing public patch, or increased risk to users from stalled remediation.
The Patch the Planet website(opens in a new window) brings together public disclosures and guidance to help operators identify affected systems, find the right update, and verify that the updated software is running properly. For PHP, it points to the maintainers’ official patch and upgrade instructions and our partners’ technical research. The guidance also covers interim mitigations, when to involve a provider or expert, and backup and recovery. Interim protections can reduce risk, but we’ll make their limits and operational tradeoffs clear.
Operators can use CISA’s guidance on prioritization and remediation(opens in a new window) to assess how quickly to act based on exposure, exploitation, and potential impact. That may mean emergency patching, immediate mitigation, or a planned update, alongside forensic triage where warranted to assess whether systems have already been compromised. Priorities should be reassessed as conditions change, with a clear path to lasting remediation.
Global coordination depends on the people who maintain the software. Many projects are run by small teams that review security reports alongside routine development. Those teams need help separating new issues from duplicates, assessing impact, and testing fixes across supported releases. We support that work with fundi
This page as .md · .json · in your agent: get_signal("CVE-2026-109619")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.