Description of PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)

A premature leak forced PHP maintainers to rush out an emergency fix on October 21, 2026, for two unauthenticated remote-code-execution bugs, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 on CVSS. The flaws, nicknamed PHP2Shell, stem from use-after-free and memory-corruption issues in how PHP core handles multipart/form-data uploads together with the session.upload_progress feature, and they reportedly hit every PHP version from 5.4.0 through the current 8.x branches — including popular platforms like WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, and WHMCS. Because exploitation requires no credentials and the issue sits in the PHP engine itself, app-level fixes won't help; vendors shipped backported patches even for end-of-life 7.4, 8.0, and 8.1, alongside supported 8.2–8.5, while researchers warn mass attacks could start within minutes of disclosure. Kaspersky says its EDR, Anti Targeted Attack (KATA), and Endpoint Security products already flag both the exploitation attempts and post-exploitation behavior tied to this campaign.