Unified platforms

Agentic Threat Intelligence AI agents that autonomously hunt, analyze, and respond to threats, continuously and at machine speed.

Extended Threat Intelligence Threat intelligence enriched with EASM, Brand Protection, and Dark Web Radar. Five modules, one platform.

Start today

Try SOCRadar free.

Full platform access. No credit card. Instant onboarding in under 2 minutes.

Start for Free

Browse All Modules

SOCRadar MCP Server Query your live platform data in plain language.SOCRadar AI Agents Specialist agents, each built for one security job.SOCRadar APIs Integrate, automate, or build on SOCRadar intelligence.

Integrations Automate and operationalize your security operations with 100+ platform integrations.Customer Stories Hear SOCRadar's impressive achievements from our clients.

From Chaos to Clarity Learn how leading security teams transformed their threat intelligence operations.Professional Services Consulting and expert services to operationalize threat intelligence from day one.

Use Cases Industries Roles

Phishing Domain Detection Spot lookalike domains before campaigns launch.Credential Leak Monitoring Catch exposed passwords across the dark web.Ransomware Defense Track the groups and IOCs targeting your sector.Third-Party Risk Watch your vendors' exposure continuously.Attack Surface Discovery Map every internet-facing asset you own.Executive Protection Track impersonation and leaks targeting your leadership.Brand Impersonation Takedown Remove fake sites and profiles abusing your brand.Payment Fraud Detection Surface compromised cards and cash-out infrastructure.Vulnerability Intelligence Prioritize patching with exploited-in-the-wild context.Dark Web Exposure See what the underground already knows about you.

Financial Services Fraud, leaks, and regulatory exposure in one view.Healthcare Protect patient data and connected systems.Government & Defense Nation-grade monitoring for critical missions.Retail & E-Commerce Stop brand abuse and card fraud at the source.Energy & Utilities Monitor threats against critical infrastructure and OT.Technology & SaaS Protect your platform, tenants and release pipeline.

CISO The full risk picture, board-ready.SOC Analyst Faster triage with enriched context.Security Operations Pivot from indicator to adversary.Threat Intelligence Analyst Curated intel mapped to your assets and sector.Fraud & Payments Team Card, account and mule activity from the dark web.MSSPs Multi-tenant intelligence across your client base.Vulnerability Management Exploit context to rank what actually gets attacked.

Reports

Country Reports Regional threat landscapes and geopolitical context.Industry Reports Sector-specific attack trends and intelligence.Dark Web Reports Exposure findings from forums and markets.Whitepapers In-depth technical research briefs.Solution Briefs How the platform solves key challenges.

Learn & explore

Webinars Expert sessions, live and recorded.SOCRadar University Free learning paths for threat-intel teams.MCP for Cybersecurity Model Context Protocol for security AI.Glossary Cyber Threat Intelligence terminology.Compliance Certifications and security posture.

Radar

• Dark Web Index
• Leaked Large Databases
• Major Cyber Attacks
• Major AI Cyber Attacks
• Critical Vulnerabilities
• Financial Data Breaches

SOCRadar Blog

Threat research, dark web insights, and cybersecurity news from our team, fresh every week.

Read the Blog

Latest Report October 2026 Brazil Threat Landscape Report 2026 Read the Report

Start here

Intelligence Search One query across every free tool: domains, IPs, hashes, CVEs and actors.FortiBleed Check New Check whether your FortiGate devices appear in the leaked configuration set.

Vulnerability & Risk

CVE Intelligence Search known-exploited vulnerabilities by CVE, vendor, product, severity and remediation status.External Attack Surface Discover subdomains, technologies, exposed services and vulnerabilities from the outside.

Threat Intelligence

Dark Web Report Popular Scan your domain for dark web exposure, stealer logs, credential leaks and hacker mentions.Ransomware Intelligence Track ransomware groups, victims and leaked data in real time.IOC Radar Search IPs, domains, hashes and CVEs across threat intelligence reports.DDoS Intelligence Monitor live DDoS attack campaigns, botnet infrastructure and flood sources.Threat Reports Analyse threats by country, industry or domain with an on-demand report.

Security Operations

SOC Incident Toolkit Investigation tooling for phishing, malware and account breach, with indicator lookup.Threat Actor Database APT groups and ransomware gangs: profiles, MITRE ATT&CK mappings, IOCs and YARA rules.Campaigns Track active attack campaigns with indicators, targeted sectors and MITRE ATT&CK mappings.wp2shell Check Check if your WordPress site is exposed to the wp2shell batch-route SQL injection.

Free tool

Dark Web Report

Scan the dark web to prevent your leaks from turning into real risks. Instant results, no account needed.

Get Your Free ReportView all free tools →

Company

About Us Our mission, values, and threat-intel approach.Careers Open roles and life at SOCRadar.Press Releases, media coverage, and brand assets.Contact Us Talk to sales, support, or partnerships.

Programs

Events Conferences, meetups, and live sessions.Cybersecurity Training Upskill your SOC and security team.

Partners

Partner Program Overview of how to partner with us.

• Value-Added Resellers
• MSSPs
• Technology Alliances

Partner program

Become a partner.

Join 316 MSSPs, resellers, and technology allies delivering SOCRadar threat intelligence to customers worldwide.

Become a PartnerExplore partnership options →

Products

Cyber Threat Intelligence Threat hunting and threat actor tracking with behavioral analytics. Advanced Dark Web Monitoring Detect credentials and sensitive data leaked on dark web markets, forums & Telegram. Attack Surface Management Discover your assets with a hacker mindset. Continuously map and monitor exposure. Brand Protection Actionable alerts against phishing, impersonation and brand abuse. Supply Chain Intelligence Detect compromised vendors and evaluate your entire supply network's posture.Agentic Threat Intelligence AI agents that autonomously hunt, analyze, and respond to threats, continuously and at machine speed.Extended Threat Intelligence Threat intelligence enriched with EASM, Brand Protection, and Dark Web Radar. Five modules, one platform.Browse All Modules

Solutions

SOCRadar MCP Server Query your live platform data in plain language.SOCRadar AI Agents Specialist agents, each built for one security job.SOCRadar APIs Integrate, automate, or build on SOCRadar intelligence.Integrations Automate and operationalize your security operations with 100+ platform integrations.Customer Stories Hear SOCRadar's impressive achievements from our clients.From Chaos to Clarity Learn how leading security teams transformed their threat intelligence operations.Professional Services Consulting and expert services to operationalize threat intelligence from day one.

Use Cases

Phishing Domain Detection Spot lookalike domains before campaigns launch.Credential Leak Monitoring Catch exposed passwords across the dark web.Ransomware Defense Track the groups and IOCs targeting your sector.Third-Party Risk Watch your vendors' exposure continuously.Attack Surface Discovery Map every internet-facing asset you own.Executive Protection Track impersonation and leaks targeting your leadership.Brand Impersonation Takedown Remove fake sites and profiles abusing your brand.Payment Fraud Detection Surface compromised cards and cash-out infrastructure.Vulnerability Intelligence Prioritize patching with exploited-in-the-wild context.Dark Web Exposure See what the underground already knows about you.Financial Services Fraud, leaks, and regulatory exposure in one view.Healthcare Protect patient data and connected systems.Government & Defense Nation-grade monitoring for critical missions.Retail & E-Commerce Stop brand abuse and card fraud at the source.Energy & Utilities Monitor threats against critical infrastructure and OT.Technology & SaaS Protect your platform, tenants and release pipeline.CISO The full risk picture, board-ready.SOC Analyst Faster triage with enriched context.Security Operations Pivot from indicator to adversary.Threat Intelligence Analyst Curated intel mapped to your assets and sector.Fraud & Payments Team Card, account and mule activity from the dark web.MSSPs Multi-tenant intelligence across your client base.Vulnerability Management Exploit context to rank what actually gets attacked.

Plans & Pricing

Resources

Country Reports Regional threat landscapes and geopolitical context.Industry Reports Sector-specific attack trends and intelligence.Dark Web Reports Exposure findings from forums and markets.Whitepapers In-depth technical research briefs.Solution Briefs How the platform solves key challenges.Webinars Expert sessions, live and recorded.SOCRadar University Free learning paths for threat-intel teams.MCP for Cybersecurity Model Context Protocol for security AI.Glossary Cyber Threat Intelligence terminology.Compliance Certifications and security posture.Dark Web IndexLeaked Large DatabasesMajor Cyber AttacksMajor AI Cyber AttacksCritical VulnerabilitiesFinancial Data Breaches

Free Tools

Intelligence Search One query across every free tool: domains, IPs, hashes, CVEs and actors.FortiBleed Check New Check whether your FortiGate devices appear in the leaked configuration set.CVE Intelligence Search known-exploited vulnerabilities by CVE, vendor, product, severity and remediation status.External Attack Surface Discover subdomains, technologies, exposed services and vulnerabilities from the outside.Dark Web Report Popular Scan your domain for dark web exposure, stealer logs, credential leaks and hacker mentions.Ransomware Intelligence Track ransomware groups, victims and leaked data in real time.IOC Radar Search IPs, domains, hashes and CVEs across threat intelligence reports.DDoS Intelligence Monitor live DDoS attack campaigns, botnet infrastructure and flood sources.Threat Reports Analyse threats by country, industry or domain with an on-demand report.SOC Incident Toolkit Investigation tooling for phishing, malware and account breach, with indicator lookup.Threat Actor Database APT groups and ransomware gangs: profiles, MITRE ATT&CK mappings, IOCs and YARA rules.Campaigns Track active attack campaigns with indicators, targeted sectors and MITRE ATT&CK mappings.wp2shell Check Check if your WordPress site is exposed to the wp2shell batch-route SQL injection.View all free tools →

Company

About Us Our mission, values, and threat-intel approach.Careers Open roles and life at SOCRadar.Press Releases, media coverage, and brand assets.Contact Us Talk to sales, support, or partnerships.Events Conferences, meetups, and live sessions.Cybersecurity Training Upskill your SOC and security team.Partner Program Overview of how to partner with us.Value-Added ResellersMSSPsTechnology AlliancesExplore partnership options →

Dark Web ReportStart for Free

• Blog

• Trainings

• Request a Demo

• Login

• English

• Español

Home›Blog›Cyber News›PHP2Shell: CVE-2026-109618 & CVE-2026-109619

Oct 21, 2026 6 Mins Read

Summarize with:

PHP2Shell: CVE-2026-109618 & CVE-2026-109619

PHP2Shell is the name researchers now use for two critical vulnerabilities in PHP, the server-side language behind WordPress, Drupal, Magento, Laravel, and many custom web applications. Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws reportedly allow Remote Code Execution (RCE), and the PHP security team rated each 9.2 on CVSS v4.0.

The flaws surfaced ahead of schedule. Their existence was leaked on October 20, 2026, two days before a coordinated disclosure, and the PHP security team responded that evening with an advance notice of an upcoming security release set for October 21, 2026, at 14:00 Coordinated Universal Time (UTC).

_Advance notice of the upcoming security release for PHP2Shell vulnerabilities_

The following FAQ separates what PHP has confirmed from what remains leaked or unverified, shows which PHP branches will receive fixes, and lists what defenders should do before and after the release.

PHP2Shell at a Glance

PHP2Shell Timeline

1. What Is PHP2Shell?

PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that researchers say let a remote attacker run code on a server running PHP. The name points to the expected result, a shell on the target.

Because the fix ships in PHP itself, protection for WordPress, Drupal, Magento, and other PHP applications depends on updating the server’s PHP version. Updating the application alone does not close the gap.

2. How Did PHP2Shell Become Public Before the Patch?

PHP2Shell became public through a leak. On October 20, 2026, details surfaced claiming that two PHP RCE flaws, rated critical and affecting every version since PHP 5, would be disclosed on Thursday, October 22, 2026. watchTowr then confirmed on X that the flaws were real and under embargo, and urged users to apply patches once available.

_WatchTowr’s post on_ _X_ _, confirming the leak of PHP2Shell vulnerabilities_

3. How Severe Are CVE-2026-109618 and CVE-2026-109619?

The PHP security team rates both flaws 9.2 on CVSS v4.0, which is critical severity. As of October 21, 2026, PHP had not published the scoring vector, root cause, or affected component for either flaw.

CERT-EU, the cybersecurity service for European Union institutions, says the 9.2 scores point to possible unauthenticated RCE.

4. Which PHP Versions Are Affected by PHP2Shell?

PHP has not yet confirmed which versions are affected. The reports claimed every release from PHP 5 onward, butno vendor advisory has confirmed that scope or described any configuration or feature requirement. PHP will publish affected and fixed versions with the release.

Fixes will ship only for the four supported PHP branches:

5. Will End-of-Life PHP Versions Get a PHP2Shell Fix?

No. End-of-life PHP branches, including 8.1, 8.0, 7.x, and 5.x, will get no fix from PHP. If PHP2Shell reaches those versions, servers running them will have no vendor patch, which makes upgrading to a supported branch the only permanent remedy.

Shodan lists around 884,000 internet-facing hosts running PHP 8.1 or older. An additional 740,000 hosts run PHP without specifying a version number.

_Shodan results for PHP hosts by version (_ _Source_ _)_

6. Is PHP2Shell Being Exploited in the Wild?

As of October 21, 2026, no in-the-wild exploitation of PHP2Shell has been reported, and neither CVE are listed in the KEV catalog of the Cybersecurity and Infrastructure Security Agency (CISA).

However, unverified attack claims are circulating. Patchstack said on October 21, 2026, that multiple active exploitation incidents had been confirmed, without publishing technical evidence. Treat such reports as unconfirmed until PHP, CERT-EU, or CISA corroborates them.

7. Is There a Public PHP2Shell Exploit or Proof-of-Concept (PoC)?

As of October 21, 2026, some online posts claim that both CVE-2026-109618 and CVE-2026-109619 have been recreated and tested in lab and real-world environments. Separately, watchTowr says it has reproduced CVE-2026-109618 and is withholding details until patches ship.

8. How Fast Could Attackers Exploit PHP2Shell After the Patch?

Attackers could move within minutes, because published fixes show where the bugs are.When CVE-2024-4577, a flaw in PHP’s Common Gateway Interface (CGI) mode on Windows, became public in June 2024, Akamai saw exploit attempts against its honeypots within 24 hours.

9. Is There a PHP2Shell Workaround Before the Patch?

PHP has published no workaround for PHP2Shell, so upgrading is the only vendor-backed fix. Where immediate patching is not feasible, CERT-EU advises organizations to consider isolating internet-facing applications from public networks until a fix can be applied.

10. How Can Security Teams Detect PHP2Shell Exploitation?

Detection has to focus on post-exploitation behavior, because PHP has not described how the flaws work. Alert when php-fpm, php-cgi, httpd, or apache2 launch shells, script interpreters, or download tools such as curl and wget.

If an alert fires, isolate the server, preserve web server and PHP logs, and hunt for web shells, new files in the web root, new cron jobs or scheduled tasks, and unexpected accounts.

11. How Can SOCRadar Help Track PHP2Shell Exposure?

With a critical PHP release landing and attacks expected soon after, organizations need to know both which PHP2Shell details are confirmed and where PHP is externally exposed.

SOCRadar can support that process through:

• Attack Surface Management****: Helps identify internet-facing assets running PHP and prioritize exposed systems, including those on end-of-life branches, for patching or isolation.
• Cyber Threat Intelligence****: Tracks CVE severity, exploitation developments, KEV status, affected and fixed versions, and changes in public vulnerability intelligence for CVE-2026-109618 and CVE-2026-109619.

_SOCRadar’s Vulnerability Intelligence, Cyber Threat Intelligence module_

Combining external asset visibility with vulnerability intelligence can help security teams find exposed PHP servers quickly while patching and compromise assessment proceed.

12. What Should Organizations Do Right Now?

Find every PHP installation now, then upgrade the moment PHP’s release lands. As of October 21, 2026, the priorities are:

• Inventory every install: Include PHP bundled in vendor appliances, Windows software, and hosting control panels such as cPanel and Plesk.
• Patch at release: Move supported branches to PHP’s fixed versions, internet-facing systems first, then restart the PHP FastCGI Process Manager (PHP-FPM) or web server so the new build loads.
• Check backports: Watch your Linux distribution and hosting provider for patched packages.
• Isolate what you cannot patch: Keep end-of-life and unpatched internet-facing systems off public networks, or behind a VPN or web application firewall, until a fix is applied.
• Verify and monitor: Confirm affected and fixed versions against PHP’s release notes, and keep watching PHP worker processes for unexpected child processes.

Yağmur Ernalbant

Yağmur is a Senior Content Development Specialist at SOCRadar, covering both breaking cybersecurity news and the broader issues behind it. Through articles and regular Radar roundups, she tracks vulnerabilities, cybercrime, dark web activity, and other developments across the threat landscape.

Table of content.

−

• PHP2Shell: CVE-2026-109618 & CVE-2026-109619
• PHP2Shell at a Glance
• PHP2Shell Timeline
• 1. What Is PHP2Shell?
• 2. How Did PHP2Shell Become Public Before the Patch?
• 3. How Severe Are CVE-2026-109618 and CVE-2026-109619?
• 4. Which PHP Versions Are Affected by PHP2Shell?
• 5. Will End-of-Life PHP Versions Get a PHP2Shell Fix?
• 6. Is PHP2Shell Being Exploited in the Wild?
• 7. Is There a Public PHP2Shell Exploit or Proof-of-Concept (PoC)?
• 8. How Fast Could Attackers Exploit PHP2Shell After the Patch?
• 9. Is There a PHP2Shell Workaround Before the Patch?
• 10. How Can Security Teams Detect PHP2Shell Exploitation?
• 11. How Can SOCRadar Help Track PHP2Shell Exposure?
• 12. What Should Organizations Do Right Now?

Related articles.

• Cisco Secure Email & PAN-OS Zero-Days Exploited Oct 15, 2026
• CVE-2026-105445: Docker Hub PAT Reassignment Flaw Oct 14, 2026
• CVE-2026-89111: Critical SAP Cloud SDK SSRF Oct 14, 2026
• October 2026 Patch Tuesday: 1,413 Flaws, 3 Zero-Days Oct 14, 2026
• Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks Oct 14, 2026

Free dark web report Is your domain/email exposed?

Get Your Free Report

See your digital assets through a hacker's eyes.

Scan in 7 Seconds

Related articles.

Oct 15, 2026 ### Cisco Secure Email & PAN-OS Zero-Days Exploited Oct 14, 2026 ### CVE-2026-105445: Docker Hub PAT Reassignment Flaw Oct 14, 2026 ### CVE-2026-89111: Critical SAP Cloud SDK SSRF Oct 14, 2026 ### October 2026 Patch Tuesday: 1,413 Flaws, 3 Zero-Days

Intelligence in your inbox every Thursday.

Join 30,000+ security professionals reading SOCRadar research.

Subscribe

Extended threat intelligence platform. Outside-in visibility across the surface, deep, and dark web, for defenders who need to act before threats land.

Get the SOCRadar brief every Thursday.

New threat research, vulnerability alerts, and dark web trends, read by 30,000+ security professionals.

Subscribe No spam. Unsubscribe any time.

Platform

• Extended Threat Intelligence
• Agentic Threat Intelligence
• Cyber Threat Intelligence
• Advanced Dark Web Monitoring
• Attack Surface Management
• Brand Protection
• Supply Chain Intelligence
• SOCRadar MCP Server
• SOCRadar AI Agents
• SOCRadar APIs
• All Modules
• Plans & Pricing

Partners

• Partner Program
• Managed Security Service Providers
• Value-Added Resellers
• Technology Alliances
• Integrations

Modules

• Threat Hunting
• Tactical Intelligence
• Operational Intelligence
• Identity & Access Intelligence
• Vulnerability Intelligence
• Digital Footprint
• Vulnerability Detection
• DNS Monitoring
• SSL Certificates Monitoring
• Executive Protection
• Fraud Protection
• Integrated Takedown
• Third-Party Companies

Use Cases

• Financial Services
• Healthcare & Pharmaceutical
• Public Sector & Defense
• Retail & E-Commerce
• Energy & Critical Infrastructure
• Technology & SaaS
• For MSSPs & MDR
• Professional Services

Radar

• Dark Web Index
• Leaked Large Databases
• Major Cyber Attacks
• Major AI Cyber Attacks
• Critical Vulnerabilities
• Financial Data Breaches

Resources

• Blog
• Reports
• Webinars
• On-Demand Webinars
• Whitepapers
• Solution Briefs
• Customer Stories
• Glossary

Free Tools

• Dark Web Report
• Industry Threat Landscape Report
• Country Threat Landscape Report
• External Threat Assessment Report
• External Attack Surface
• IOC Radar
• Campaigns
• SOC Tools

Company

• About Us
• Careers
• Events
• Press
• Brand Guidelines
• Contact Us
• Request a Demo

Trust & Security

• Trust Center
• Security Center
• Vulnerability Reporting
• Security Hall of Fame
• Compliance

Offices

• Newark, Delaware HQ 254 Chapman Rd, Ste 208, Newark, Delaware 19702
• Istanbul Türkiye
• London United Kingdom
• Madrid Spain
• Dubai United Arab Emirates
• São Paulo Brazil
• Tokyo Japan
• Bangalore India

All addresses and contacts

• 
• 
• 
• 
• 4.7/5★★★★★★★★★★
• 
• 
• 
• 
• 
• 

© 2026 SOCRadar Cyber Intelligence Inc. All rights reserved.

• Privacy Policy
• Information Security Policy
• Terms of Service
• Non-Disclosure Agreement

Cookies and measurement

We use necessary cookies to run the site. Analytics and advertising tags wait for your choice. You can change this later. Privacy policy

Reject optional Accept all

Text extracted automatically; images, tables and formatting may be missing. Original: https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/