PHP2Shell: PHP RCE flaws CVE-2026-109618 and CVE-2026-109619

Two critical remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, are being tracked as the PHP2Shell vulnerability. Both score 9.2 on CVSS 4.0, and Unit 42 says it has seen proof of concept code and at least one attack on a European government target. Neither CVE is listed in CISA KEV in our data, but treat both as urgent, because PHP runs a large share of web servers and CMS sites. Details come from Unit 42’s threat brief, updated October 23.

What happened

The PHP Foundation announced a critical security release on October 21 covering both flaws, according to Cisco’s advisory. The project’s own advisories are GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.

• CVE-2026-109618: PHP uses longjmp() to abort a request on out-of-memory errors. Some code paths leave request memory uninitialized before an allocation, and cleanup later reads or branches on it. Several out-of-memory strategies trigger this reliably and lead to RCE.
• CVE-2026-109619: global state that temporarily points into request memory may not be reset, or may be repopulated, so it refers to freed memory. A later request can use that stale state before it is initialized, which also leads to RCE.

Why this matters

Analysis, not new facts: PHP sits behind a huge number of internet-facing sites, and both bugs are triggered through ordinary requests. Unit 42 reports that Palo Alto Networks Cortex Xpanse telemetry shows over 22.6 million potentially vulnerable exposed instances. Public proof of concept plus observed exploitation means the window to patch is hours, not weeks, for any internet-facing PHP host.

Unit 42 also saw attackers using agentic AI platforms after exploitation. In the European government case, within two hours of initial exploitation they reached password hashes and multi-factor authentication secrets, set up an NTLM-relay tunnel into Active Directory and tried to escalate to Domain Admin.

Am I affected?

Any deployment running PHP before the fixed release is potentially affected. The fixed PHP version numbers are not disclosed in the data we reviewed, so check the PHP advisories linked above. Vendor product status so far:

• Palo Alto Networks: PAN-OS on PA-Series and VM-Series firewalls is affected. Fixes are listed with estimated dates, for example 12.2.4-h1 (ETA 10/28) and 11.2.10-h16 (ETA 10/26). Cortex XCORE (SaaS) and WildFire Cloud were affected and already patched on October 21 and October 22. Most other Palo Alto products, including Cortex XDR, Prisma Cloud and GlobalProtect App, are listed as unaffected.
• Cisco: still investigating. Products under review include Identity Services Engine, Catalyst Center, several Catalyst SD-WAN components and Smart Software Manager On-Prem. Cisco states that products not listed are not affected, and no workarounds are available.

The NVD record lists PAN-OS 10.2 and 11.1 releases as affected, which covers only part of what the vendors describe, so use vendor advisories as the source of truth.

Technical details

• CVSS 4.0 base score 9.2 (critical) in NVD for both CVEs, network attack vector, high attack complexity.
• Palo Alto Networks rates its own product impact as 8.7 (high) with low attack complexity, and describes the product impact as availability only. The scores differ because they measure different things, so do not compare them directly.
• CWEs: CWE-416 (use after free), CWE-755, CWE-824 and CWE-1325.
• EPSS: 11.6% for CVE-2026-109618 and 6.0% for CVE-2026-109619.
• Exploitation: proof of concept seen by Unit 42 and at least one government attack observed. Neither CVE has a KEV entry in our data.

How to detect exploitation

Unit 42 describes web shell activity with recon commands whose output was wrapped in section-header delimiters such as ==SHELLUSER== and ==PASSWD==, short serially spaced tasks, and quick pivots after failures. Hunt for web server processes spawning shells, new files in web roots, and NTLM relay or unusual authentication from web hosts. IOCs were not published in the data we reviewed.

What to do

1. Inventory PHP versions on internet-facing hosts, containers and CMS images, and apply the PHP Foundation’s security release as soon as your distribution ships it.
2. If you run PAN-OS, plan the hotfix for your train when it is available and follow the vendor advisory in the meantime.
3. Check the Cisco advisory for your products, which Cisco says it will update.
4. Where you cannot patch yet, restrict exposure of PHP apps, for example behind a WAF or by temporarily taking non-essential sites offline, as one European government did.
5. Hunt for web shells and post-exploitation activity from the past several days, and rotate credentials and MFA secrets on any host that looks compromised.

Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.

Related coverage

• PAN-OS management interface RCE exploited (CVE-2026-0322)
• Adobe Commerce BlockStrap RCE flaw patched (CVE-2026-103849)
• Hitachi Energy SOI exposed to ActiveMQ RCE flaw (CVE-2026-34197)

Sources

• Cisco Security Advisory: Vulnerabilities in PHP Affecting Cisco Products
• Palo Alto Networks advisory CVE-2026-109618
• NVD: CVE-2026-109618
• NVD: CVE-2026-109619
• Unit 42 Threat Brief