CRITICALVulnerability
Global

Two Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell Now

·Source: Qualys Blog

Updated:

Executive Summary

Executive Summary PHP2Shell is two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) that can allow unauthenticated remote code execution on PHP installations serving web requests. Researchers have also demonstrated unauthenticated disclosure of PHP worker memory, which can expose passwords, authentication tokens, and API keys. Cloudflare has already reported attack tra

Analysis

Executive Summary PHP2Shell is two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) that can allow unauthenticated remote code execution on PHP installations serving web requests. Researchers have also demonstrated unauthenticated disclosure of PHP worker memory, which can expose passwords, authentication tokens, and API keys. Cloudflare has already reported attack traffic, including attempts to evade […]

Indicators of Compromise (2)

CVE (2)
CVE-2026-109618
NVDMITRE CVE
CVE-2026-109619
NVDMITRE CVE
Source Attribution

Originally published by Qualys Blog on Oct 21, 2026.

Related Threats

MEDIUMVulnerabilityNEW

Coinbase fined €3.25m by Irish central bank

Crypto exchange Coinbase Ireland has been penalised by the Central Bank of Ireland (CBI) for a series of operational and governance failings over a five-year period.

Finextra
MEDIUMVulnerabilityNEW

GitLab warns of new max severity code execution vulnerability

GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. [...]

BleepingComputer
MEDIUMVulnerabilityNEW

Barclays to cut 5,000 jobs amid AI expansion

Barclays is the latest high street bank to announce a headcount reduction at the same time as an expansion in the use of AI.

Finextra