PHP2Shell Vulnerability Update (CVE-2026-109618 & CVE-2026-109619)

Publisher preview

PHP2Shell refers to two critical vulnerabilities in PHP’s core runtime, CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state), both rated 9.2 under CVSS. The flaws affect PHP’s memory management and error handling, rather than a specific application or framework. AI-assisted security research involving Wiz Research, OpenAI, and Calif helped demonstrate practical exploitation and supported coordinated remediation with PHP maintainers. Under certain conditions, threat actors can exploit these vulnerabilities remotely, without authentication, to execute malicious code or access sensitive process memory, potentially exposing passwords, authentication tokens, and API keys. Affected websites and applications may be exposed even when their application code is secure. Exploitability varies by deployment and configuration, and malicious code runs with the permissions of the PHP service. Further compromise depends on the systems and credentials accessible to that service. PHP released emergency security updates on October 21, 2026. AWS reported exploitation attempts dating back to October 17, before public disclosure. Organizations running affected versions should prioritize immediate patching and review earlier activity for signs of exploitation.

A saved ApplyDjinn digest is not available for this story yet.

This preview is supplied by the publisher. The complete publication remains at its original source.