CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHP
PoC publicPHPWordPressOur summary
On October 21, 2026, the PHP core team shipped an emergency out-of-band release fixing two critical, unauthenticated remote code execution flaws nicknamed php2shell. CVE-2026-109618 is a use-after-free memory corruption bug in the var_unserializer/session deserialization logic, while CVE-2026-109619 is an input-validation flaw letting attackers fix session IDs via POST data and smuggle arbitrary bytes into session files through unsanitized upload filenames — both tied to the default-enabled session.upload_progress feature and both rated 9.2 (Critical) on CVSS v4.0. Because PHP underlies countless WordPress, Magento, Drupal and Laravel deployments, and researchers found hundreds of thousands of internet-facing hosts still running old PHP versions, the exposure is massive even though exploitation often requires chaining with an application-level flaw such as local file inclusion. Fixes are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and administrators are urged to upgrade immediately, restrict public access to unpatched instances, and avoid unverified third-party patches or PoC scripts circulating online.
Below is the opening; the full story is at OX Security.
From OX Security
Two critical PHP vulnerabilities, collectively dubbed php2shell, were disclosed on October 20, 2026. Left unpatched, these flaws allow unauthenticated remote attackers to gain full code execution on virtually any publicly accessible PHP instance. The issues have been officially resolved in PHP versions 8.2.35, 8.3.36, 8.4.27, 8.5.12.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.