PHP2Shell
2026 software security vulnerability
From Wikipedia, the free encyclopedia
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in thecommon web scripting language PHP. It allows arbitrary code execution on any website that runs PHP versions 5 through 8.[1]
The vulnerability was rated 9.2 out of 10 under CVSS v4.0.[2] Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected[3], with an emergency patch scheduled for release on the 21st October 2026 at 14:00 UTC.[4][3]
It is notable for the fact that the PHP maintainers announced the update early and before release[5], encouraging users to prepare and update as soon as the patch was released. One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release".[1]