--- schema: 1 kind: vulnerability title: "CVE-2026-109618 / CVE-2026-109619, PHP: two critical flaws rated CVSS 4.0 9.2, which CERT-EU reads as possible remote code execution, are to be fixed in a release pre-announced for 21 October 14:00 UTC, with a screenshot of an exploit tool reported leaked" headline: "PHP announces a critical security release for 14:00 UTC on 21 October; an exploit tool screenshot is reported leaked" summary: > The PHP security team announced on 2026-10-20 a security release for Wednesday 2026-10-21 at 14:00 UTC that fixes two critical flaws, both CVSS 4.0 9.2, and may ship earlier if details leak or exploitation starts. CERT-EU names them CVE-2026-109618 and CVE-2026-109619 and reads them as potential unauthenticated remote code execution, and Sansec reports a leaked screenshot of an exploit tool and expects mass attacks within 15 minutes of the release. The fix goes into the PHP runtime on the host or in the container image, not into any CMS or plugin, and PHP 8.1 and older are outside upstream support. discovered_at: "2026-10-21T03:40:00Z" updated_at: null event_date: "2026-10-20" run_id: 2026-10-21T0256Z-intel priority: high immediate_action: null tags: [vulnerabilities, rce, no-patch] regions: [global] sectors: [] entities: ["product:php", "tool:php2shell"] techniques: [T1190] affected_products: ["PHP"] cves: - id: CVE-2026-109618 cvss: "9.2 (CVSS 4.0)" epss: null type: rce vector: zero-click auth: pre-auth status: [no-patch] affected: "not stated by the PHP project; CERT-EU says all PHP versions from PHP 5 onwards, Sansec says PHP 5.4 or later" fixed: "none published as of 2026-10-21; a fixed release is scheduled for 14:00 UTC the same day" - id: CVE-2026-109619 cvss: "9.2 (CVSS 4.0)" epss: null type: rce vector: zero-click auth: pre-auth status: [no-patch] affected: "not stated by the PHP project; CERT-EU says all PHP versions from PHP 5 onwards, Sansec says PHP 5.4 or later" fixed: "none published as of 2026-10-21; a fixed release is scheduled for 14:00 UTC the same day" sources: - url: "https://www.php.net/archive/2026.php#2026-10-20-1" publisher: "PHP (php.net news archive, Upcoming Critical PHP Security Release)" date: "2026-10-20" role: primary - url: "https://cert.europa.eu/publications/security-advisories/2026-018/" publisher: "CERT-EU (Security Advisory 2026-018)" date: "2026-10-21" role: corroborating - url: "https://sansec.io/research/php2shell" publisher: "Sansec" date: "2026-10-21" role: corroborating - url: "https://www.wordfence.com/blog/2026/10/psa-upcoming-critical-php-security-release/" publisher: "Wordfence" date: "2026-10-20" role: corroborating closed_sources: [] evidence: - quote: "It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC." publisher: "PHP (php.net news archive, Upcoming Critical PHP Security Release)" source_url: "https://www.php.net/archive/2026.php#2026-10-20-1" - quote: "It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2." publisher: "PHP (php.net news archive, Upcoming Critical PHP Security Release)" source_url: "https://www.php.net/archive/2026.php#2026-10-20-1" - quote: "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." publisher: "PHP (php.net news archive, Upcoming Critical PHP Security Release)" source_url: "https://www.php.net/archive/2026.php#2026-10-20-1" - quote: "These vulnerabilities could affect all PHP versions from PHP 5 onwards" publisher: "CERT-EU" source_url: "https://cert.europa.eu/publications/security-advisories/2026-018/" - quote: "We expect mass attacks to start within 15 minutes of the release." publisher: "Sansec" source_url: "https://sansec.io/research/php2shell" - quote: "Servers on PHP 8.1 or older will not get an official fix." publisher: "Sansec" source_url: "https://sansec.io/research/php2shell" verification: multi-source sourcing_note: > The PHP project's announcement is the primary and carries only the release date, the two CVSS 4.0 scores and the right to release earlier, and Wordfence repeats it. CERT-EU and Sansec add leak-based claims the project has not confirmed (the CVE ids, the exploit-tool screenshot and the version ranges, which differ: PHP 5 onwards against PHP 5.4 or later); the unauthenticated reading of the flaws is CERT-EU's interpretation of the scores, and neither CVE id was yet in the CVE.org record service or EUVD on 2026-10-21. confidence: medium references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: - "Before 14:00 UTC on 2026-10-21 list every internet-facing host and container image that runs PHP with its version (php -v) and its owner, find those on PHP 8.1 or older, and agree who restarts PHP-FPM or the web server once the fixed build is published; ask each hosting provider and distribution for its date, because OS packages, control panels and container images may follow a different schedule from php.net." updates: [] migrated_from: null --- The PHP security team announced on 2026-10-20 a security release for Wednesday 2026-10-21 at 14:00 UTC that addresses two critical vulnerabilities, both rated CVSS 4.0 9.2, with the affected and fixed versions and the technical details to be published with the release; it reserves the right to release earlier if details become public or exploitation appears ([PHP, 2026-10-20](https://www.php.net/archive/2026.php#2026-10-20-1)). CERT-EU names the two as CVE-2026-109618 and CVE-2026-109619, reads their scores as indicating potential unauthenticated remote code execution and, citing a social-media post, says they could affect all PHP versions from PHP 5 onwards ([CERT-EU, 2026-10-21](https://cert.europa.eu/publications/security-advisories/2026-018/)). Sansec reports that information on the embargoed bugs leaked on 20 October, that watchTowr confirmed them as remote code execution flaws in PHP, and that a screenshot of an exploit tool named PHP2Shell, credited to Calif.IO, leaked with a banner claiming it works against every PHP release from 5.4.0; it expects mass attacks within 15 minutes of the release ([Sansec, 2026-10-21](https://sansec.io/research/php2shell)). Those are Sansec's claims; the PHP project has published no technical detail and no fix is listed on php.net as of 2026-10-21. PHP supports branches 8.2 and later, so Sansec says servers on PHP 8.1 or older will not get an official fix ([Sansec, 2026-10-21](https://sansec.io/research/php2shell)). The fix is applied to the PHP runtime on the server, not to a CMS, plugin or theme, so updating WordPress or its plugins does not change exposure, and PHP installed from operating-system packages, a control panel or container images may arrive on a different schedule from php.net ([Wordfence, 2026-10-20](https://www.wordfence.com/blog/2026/10/psa-upcoming-critical-php-security-release/)). **Exposure:** every internet-facing server or container image that runs PHP, whoever operates it; on WordPress the running PHP version is shown under Tools > Site Health > Info > Server ([Wordfence, 2026-10-20](https://www.wordfence.com/blog/2026/10/psa-upcoming-critical-php-security-release/)). Which versions the flaws touch is not established: CERT-EU says PHP 5 onwards and Sansec says 5.4 or later, both unconfirmed. **Detection:** no flaw-specific signal is public. In the first hours after the release, watch web access logs for bursts of unusual requests to PHP endpoints from many sources, and in process-creation telemetry for web server or PHP-FPM worker processes spawning shells, interpreters or download tools, for new or modified PHP files under web roots and upload directories, and for outbound connections opened by the web server account. **Defender takeaway:** treat 14:00 UTC as a patch-now window and install the fixed PHP build on every internet-facing server the same day, internet-facing hosts first; CERT-EU says that where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available ([CERT-EU, 2026-10-21](https://cert.europa.eu/publications/security-advisories/2026-018/)). Sansec says servers on PHP 8.1 or older will not get an official fix and should ask their provider for a backport or a move to a supported version ([Sansec, 2026-10-21](https://sansec.io/research/php2shell)), and a CMS update does not substitute for the runtime update ([Wordfence, 2026-10-20](https://www.wordfence.com/blog/2026/10/psa-upcoming-critical-php-security-release/)).