Research

php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619

CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges on a web server spawning a shell, and the Elastic detections developed to catch this behavior.

Read at Elastic Security Labs

Vendor

PHP

Product

PHP

EPSS

1.00 (p100)

Exposure class

Web platform

• Elastic Security Labs (elastic.co)
• CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 79
   Tenable research Tenable 2d ago

   php2shell one week later: Why one exploit doesn’t work everywhere

   Exploited CVSS 9.2 EPSS 0.16 Fix available CVE-2026-109618CVE-2026-109619CVE-2021-44228+1 more PHP
2. 31
   News The Register 2d ago

   Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

   EPSS 0.16 CVE-2026-109618CVE-2026-109619CVE-2026-46300 PHP
3. 58
   Research Censys 2d ago

   Censys takes census of the Internet like no one else

   CVSS 9.2 EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
4. 61
   News The Register 4d ago

   CISA confirms PHP2Shell under attack as researchers clock successful exploits

   Exploited EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
5. 36
   Research Cloudflare 4d ago

   Introducing the Cloudflare PHP Capture the Flag challenge

   EPSS 1.00 CVE-2026-109618CVE-2026-109619 Cloudflare
6. 41
   Tenable research Tenable 5d ago

   Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

   EPSS 1.00 Fix available CVE-2026-111497CVE-2026-109618CVE-2026-109619 Google Node.js
7. 36
   Tenable research Tenable 5d ago

   Discover and remediate PHP2Shell exposure with Tenable

   EPSS 1.00 No fix yet CVE-2026-109618CVE-2026-109619 Tenable PHP
8. 33
   Research Check Point Research 5d ago

   26th October – Threat Intelligence Report

   EPSS 1.00 CVE-2026-109618CVE-2026-109619CVE-2026-115560+2 more
9. 38
   ESET research ESET 5d ago

   PHP2Shell: What to know about two critical PHP flaws

   EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
10. 64
    CISA alert CISA 5d ago

    CISA Adds Two Known Exploited Vulnerabilities to Catalog

    Exploited EPSS 1.00 CVE-2026-109618CVE-2026-109619
11. 36
    News The Register 6d ago

    PHP2Shell: No login, no app code, no warning. What next?

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
12. 41
    Qualys TRU Qualys 6d ago

    Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own

    EPSS 1.00 Fix available CVE-2026-109618CVE-2026-109619 Qualys PHP
13. 35
    Palo Alto advisory Palo Alto PSIRT 7d ago

    Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 Palo Alto Networks
14. 51
    Google Cloud bulletin Google Cloud 8d ago

    GCP-2026-074

    EPSS 1.00 Fix available CVE-2026-93327CVE-2026-85299CVE-2026-109618+1 more Google
15. 46
    Cisco advisory Cisco PSIRT 8d ago

    Vulnerabilities in PHP Affecting Cisco Products: October 2026

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 Cisco PHP
16. 34
    News The Register 8d ago

    There's a third PHP2Shell bug, but it won't get an emergency fix

    EPSS 1.00 CVE-2026-115560CVE-2026-109618CVE-2026-109619 PHP
17. 31
    Research Unit 42 8d ago

    Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

    EPSS 1.00 CVE-2026-109618CVE-2026-109619
18. 34
    Research Horizon3 8d ago

    CVE-2026-109618 / CVE-2026-109619

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
19. 37
    CCCS advisory CCCS 8d ago

    AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619

    EPSS 1.00 CVE-2026-109618CVE-2026-109619CVE-2026-115560
20. 50
    Docker security Docker 8d ago

    PHP2Shell and eMudhra Patched

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 Docker PHP