Research

PHP2Shell Exploitation: Two Critical PHP Flaws Explained

Two critical PHP remote code execution flaws (PHP2Shell) are reportedly being exploited. See who’s exposed, how the exploits work, and how to remediate now.

Read at Recorded Future Insikt Group

Vendor

PHP

Product

PHP

EPSS

1.00 (p100)

Exploitation

observed in the wild

Exposure class

Web platform

• Recorded Future Insikt Group (recordedfuture.com)
• CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 79
   Tenable research Tenable 2d ago

   php2shell one week later: Why one exploit doesn’t work everywhere

   Exploited CVSS 9.2 EPSS 0.16 Fix available CVE-2026-109618CVE-2026-109619CVE-2021-44228+1 more PHP
2. 31
   News The Register 2d ago

   Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

   EPSS 0.16 CVE-2026-109618CVE-2026-109619CVE-2026-46300 PHP
3. 58
   Research Censys 2d ago

   Censys takes census of the Internet like no one else

   CVSS 9.2 EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
4. 61
   News The Register 4d ago

   CISA confirms PHP2Shell under attack as researchers clock successful exploits

   Exploited EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
5. 36
   Research Cloudflare 4d ago

   Introducing the Cloudflare PHP Capture the Flag challenge

   EPSS 1.00 CVE-2026-109618CVE-2026-109619 Cloudflare
6. 41
   Tenable research Tenable 5d ago

   Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

   EPSS 1.00 Fix available CVE-2026-111497CVE-2026-109618CVE-2026-109619 Google Node.js
7. 36
   Tenable research Tenable 5d ago

   Discover and remediate PHP2Shell exposure with Tenable

   EPSS 1.00 No fix yet CVE-2026-109618CVE-2026-109619 Tenable PHP
8. 33
   Research Check Point Research 5d ago

   26th October – Threat Intelligence Report

   EPSS 1.00 CVE-2026-109618CVE-2026-109619CVE-2026-115560+2 more
9. 38
   ESET research ESET 5d ago

   PHP2Shell: What to know about two critical PHP flaws

   EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
10. 64
    CISA alert CISA 5d ago

    CISA Adds Two Known Exploited Vulnerabilities to Catalog

    Exploited EPSS 1.00 CVE-2026-109618CVE-2026-109619
11. 36
    News The Register 6d ago

    PHP2Shell: No login, no app code, no warning. What next?

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
12. 41
    Qualys TRU Qualys 6d ago

    Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own

    EPSS 1.00 Fix available CVE-2026-109618CVE-2026-109619 Qualys PHP
13. 35
    Palo Alto advisory Palo Alto PSIRT 7d ago

    Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 Palo Alto Networks
14. 51
    Google Cloud bulletin Google Cloud 8d ago

    GCP-2026-074

    EPSS 1.00 Fix available CVE-2026-93327CVE-2026-85299CVE-2026-109618+1 more Google
15. 46
    Cisco advisory Cisco PSIRT 8d ago

    Vulnerabilities in PHP Affecting Cisco Products: October 2026

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 Cisco PHP
16. 34
    News The Register 8d ago

    There's a third PHP2Shell bug, but it won't get an emergency fix

    EPSS 1.00 CVE-2026-115560CVE-2026-109618CVE-2026-109619 PHP
17. 31
    Research Unit 42 8d ago

    Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

    EPSS 1.00 CVE-2026-109618CVE-2026-109619
18. 34
    Research Horizon3 8d ago

    CVE-2026-109618 / CVE-2026-109619

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
19. 37
    CCCS advisory CCCS 8d ago

    AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619

    EPSS 1.00 CVE-2026-109618CVE-2026-109619CVE-2026-115560
20. 50
    Docker security Docker 8d ago

    PHP2Shell and eMudhra Patched

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 Docker PHP