--- title: php2shell (CVE-2026-109618, CVE-2026-109619): Critical... description: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are getting emergency patches on October 21, 2026 at 14:00 UTC. Both are rated CVSSv4.0... canonical: https://daily.dev/posts/php2shell-cve-2026-109618-cve-2026-109619-critical-php-rce-faq-b4y72ro9q twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | daily.dev og:description: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are getting emergency patches on October 21, 2026 at 14:00 UTC. Both are rated CVSSv4.0... og:url: https://daily.dev/posts/php2shell-cve-2026-109618-cve-2026-109619-critical-php-rce-faq-b4y72ro9q og:image: https://api.daily.dev/og/posts/B4Y72RO9q.png og:image:alt: php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ **[Tenable Blog](https://daily.dev/sources/tenable-blog)** · 6 min read · 0 upvotes · 0 comments ## Summary Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are getting emergency patches on October 21, 2026 at 14:00 UTC. Both are rated CVSSv4.0 9.2 by the PHP security team, though some early reports put them at CVSS 10.0. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with end-of-life branches not expected to receive fixes. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare's CTO says the company is seeing early attacks emerging. Silas Cutler estimates over 1.3 million internet-exposed hosts are potentially vulnerable. PHP core developer Gina Peter Banyard said the only mitigation is patching and upgrading PHP, while PHP 8.6 release manager Joe Ferguson said 'ini settings won't save you'. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are CVE-2026-109618 and CVE-2026-109619 and how severe are they? They are two critical PHP vulnerabilities, both rated CVSSv4.0 9.2 by the PHP security team, publicly described as remote code execution flaws. Some early reports from watchTowr and Hacker News rated them as CVSS 10.0. The PHP security team had not published technical details before the emergency patch release scheduled for October 21, 2026 at 14:00 UTC. _Teams scrambling to assess RCE severity before patching can track CVE details as they're confirmed on daily.dev._ ### Which PHP versions fix CVE-2026-109618 and CVE-2026-109619? The expected fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released in an emergency patch on October 21, 2026 at 14:00 UTC. End-of-life PHP branches are not expected to receive official fixes, and Linux distributions shipping older PHP packages may backport fixes separately, so check vendor advisories. _Developers planning an urgent PHP upgrade can follow version-specific patch guidance on daily.dev._ ### Can I mitigate the PHP php2shell vulnerabilities without upgrading PHP immediately? No reliable mitigation exists besides patching. PHP core developer Gina Peter Banyard said the only mitigation is patching or upgrading PHP, and PHP 8.6 release manager Joe Ferguson said disabling the session upload progress ini setting 'won't save you.' Cloudflare deployed WAF rules for known exploit vectors as a stopgap, available to all customers including free tier, but these only cover traffic routed through Cloudflare. _Admins weighing stopgap defenses versus patching can compare mitigation tradeoffs on daily.dev._ ## Similar posts on daily.dev - [wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins](https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu) · Latest Hacking News · 2 upvotes · 0 comments - [cPanel’s Black Week: Three New Vulnerabilities Patched After Ransomware Attack on 44,000 Servers](https://daily.dev/posts/cpanel-s-black-week-three-new-vulnerabilities-patched-after-ransomware-attack-on-44-000-servers-0xpcd5ijz) · Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/php2shell-cve-2026-109618-cve-2026-109619-critical-php-rce-faq-b4y72ro9q) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ","url":"https://daily.dev/posts/php2shell-cve-2026-109618-cve-2026-109619-critical-php-rce-faq-b4y72ro9q","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/php2shell-cve-2026-109618-cve-2026-109619-critical-php-rce-faq-b4y72ro9q"},"datePublished":"2026-10-21T09:40:25.097Z","dateModified":"2026-10-21T10:26:59.032Z","description":"Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are getting emergency patches on October 21, 2026 at 14:00 UTC. Both are rated CVSSv4.0...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e368874d590f07a2b35c5436428717bb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e368874d590f07a2b35c5436428717bb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Tenable Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Tenable Blog","logo":"https://media.daily.dev/image/upload/s--B6GAvw3H--/f_auto,q_auto/v1780213271/logos/tenable-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/tenable-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/php2shell-cve-2026-109618-cve-2026-109619-critical-php-rce-faq-b4y72ro9q","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,cloudflare","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tenable Blog","item":"https://daily.dev/sources/tenable-blog"},{"@type":"ListItem","position":3,"name":"php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/php2shell-cve-2026-109618-cve-2026-109619-critical-php-rce-faq-b4y72ro9q#faq","mainEntity":[{"@type":"Question","name":"What are CVE-2026-109618 and CVE-2026-109619 and how severe are they?","acceptedAnswer":{"@type":"Answer","text":"They are two critical PHP vulnerabilities, both rated CVSSv4.0 9.2 by the PHP security team, publicly described as remote code execution flaws. Some early reports from watchTowr and Hacker News rated them as CVSS 10.0. The PHP security team had not published technical details before the emergency patch release scheduled for October 21, 2026 at 14:00 UTC. Teams scrambling to assess RCE severity before patching can track CVE details as they're confirmed on daily.dev."}},{"@type":"Question","name":"Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?","acceptedAnswer":{"@type":"Answer","text":"The expected fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released in an emergency patch on October 21, 2026 at 14:00 UTC. End-of-life PHP branches are not expected to receive official fixes, and Linux distributions shipping older PHP packages may backport fixes separately, so check vendor advisories. Developers planning an urgent PHP upgrade can follow version-specific patch guidance on daily.dev."}},{"@type":"Question","name":"Can I mitigate the PHP php2shell vulnerabilities without upgrading PHP immediately?","acceptedAnswer":{"@type":"Answer","text":"No reliable mitigation exists besides patching. PHP core developer Gina Peter Banyard said the only mitigation is patching or upgrading PHP, and PHP 8.6 release manager Joe Ferguson said disabling the session upload progress ini setting 'won't save you.' Cloudflare deployed WAF rules for known exploit vectors as a stopgap, available to all customers including free tier, but these only cover traffic routed through Cloudflare. Admins weighing stopgap defenses versus patching can compare mitigation tradeoffs on daily.dev."}}]} ```