CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks
*October 26, 2026: This advisory has been updated to clarify language describing exploitability and potential impact.*October 23, 2026: This advisory has been updated with new ThreatLabz analysis and Zscaler Deception telemetry on exploitation activity observed during the first 48 hours following disclosure.IntroductionOn October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” were publicly disclosed. Both vulnerabilities carry a CVSS v4.0 score of 9.2 out of 10. The PHP security team has released emergency patches and strongly encouraged all PHP users to update immediately. These flaws reside i
- Vendor
- Zscaler, PHP
- Product
- Zscaler Client Connector / ZIA / ZPA, PHP
- CVSS v4.0
- 9.2
- EPSS
- 1.00 (p100)
- Exploitation
- observed in the wild
- Fix
- not yet available
- Exposure class
- Edge / VPN / firewall, Web platform
Why it ranks 86 (Critical)
- Exploitation observed in the wild
- CVSS v4.0 9.2 critical
- EPSS 1.00 (high probability of exploitation)
- Exposed product class: edge / VPN / firewall
- Covered by 36 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Zscaler ThreatLabz (zscaler.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.