php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
Two critical PHP vulnerabilities could lead to unauthenticated remote code execution. Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure. Change log Update October 28: Clarified Amazon Threat Intelligence's wording to say php2shell is seeing broad exploitation attempts in the wild. Added Dream Research's report of a campaign that chained php2shell with the Fragnesia Linux kernel flaw (CVE-2026-46300) to gain root access on firewalls. Click here to review the change log history Update October 28: Clarified Amazon Threat Intelligence's wording to say php2shell is seeing broad exploitation attempts in the wild. Added Dream Research's r
- Vendor
- PHP
- Product
- PHP
- CVSS v4.0
- 9.2
- EPSS
- 0.16 (p97)
- Exploitation
- observed in the wild
- Fix
- not yet available
- Exposure class
- Web platform, Network management
Why it ranks 68 (High)
- Exploitation observed in the wild
- CVSS v4.0 9.2 critical
- EPSS 0.16 (elevated)
- Product class: web platform, network management
- Covered by 38 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Tenable Research (tenable.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-46300 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-115560 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.