Tenable Blogpublished Oct 21, 09:01 UTC (1d ago)ingested Oct 21, 09:48 UTCby Satnam Narang

Part of a story covered by 21 sources: “Critical Vulnerabilities in PHP Require Immediate Patching” — merged summary and timeline →

php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

criticalVulnerability exploited in the wildimportance 75CVE-2026-109618 CVE-2026-109619 CVE-2024-4577 CVE-2019-11043 CVE-2012-1823

AI summary

Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it…

Read the original

Tags#cve-2026-109618 #cve-2026-109619 #cve-2024-4577 #cve-2019-11043 #cve-2012-1823 #vulnerability

Vulnerabilities mentionedAll →

CVE-2012-1823—100%
PHP-CGI Query String Parsing Flaw Enables Unauthenticated Remote Code Execution
published —· PHP KEV
CVE-2019-110439.8100%
Buffer Overflow in PHP-FPM Enables Unauthenticated RCE on nginx Stacks

Full article1,105 words · extracted from tenable.com · click to collapse

Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches.

Key takeaways

CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities.
watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging.
The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes.

Background

Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026.

FAQ

When were these PHP vulnerabilities first disclosed?

On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr, the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo.

A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io.

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
— The PHP Foundation (@ThePHPF) October 20, 2026

What are CVE-2026-109618 and CVE-2026-109619?

CVE	Description	CVSSv4.0
CVE-2026-109618	Unspecified PHP Vulnerability	9.2
CVE-2026-109619	Unspecified PHP Vulnerability	9.2

CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release.

CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory.

Which PHP versions are affected?

CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions:

Affected Versions	Fixed Version (expected)
PHP 8.5.x	8.5.12
PHP 8.4.x	8.4.27
PHP 8.3.x	8.3.36
PHP 8.2.x	8.2.35
PHP 5.x through 8.1.x	End-of-life, no fix expected

Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories.

How widespread is PHP, and how many hosts are potentially affected?

According to W3Techs, PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP.

Has exploitation been observed in the wild?

On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its mitigations as new attack vectors appear. watchTowr told BleepingComputer it believes it has reproduced CVE-2026-109618.

PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
— Dane Knecht 🦭 (@dok2001) October 21, 2026

Is there a proof-of-concept (PoC) available?

Code claiming to exploit these vulnerabilities is circulating publicly, but we have not verified that any of it works against CVE-2026-109618 or CVE-2026-109619. Unverified exploit code is sometimes laced with malware, so treat it with caution.

Are patches or mitigations available?

Not yet. Patches are scheduled for release on October 21, 2026 at 14:00 UTC (10:00 AM ET). The expected fixed versions are listed in the table above. End-of-life PHP branches are not expected to receive official fixes.

PHP core developer Gina Peter Banyard said that "the only mitigation is patching / upgrading PHP." Responding to a suggestion that included turning off session upload progress, a PHP configuration setting, PHP 8.6 release manager Joe Ferguson said that "ini settings won't save you."

Other steps can reduce exposure until you can patch, but none of them replaces the fix. Where immediate patching is not feasible, CERT-EU recommends that organizations consider isolating internet-facing applications from public networks until a fix is available.

Cloudflare has deployed WAF rules for the known exploit vectors, available to all customers including the free tier. Cloudflare describes this as a stopgap only. The rules only cover traffic routed through Cloudflare.

Have PHP vulnerabilities been exploited before?

Yes. The CISA Known Exploited Vulnerabilities (KEV) catalog includes three vulnerabilities in PHP itself. Two of them are known to have been used in ransomware campaigns:

CVE	Product	Added to KEV	Ransomware Use	Tenable Blog
CVE-2024-4577	PHP (CGI)	2024	Known	CVE-2024-4577: Proof of Concept Available for PHP-CGI Argument Injection Vulnerability
CVE-2019-11043	PHP-FPM	2022	Known	CVE-2019-11043: Vulnerability in PHP-FPM Could Lead to Remote Code Execution on nginx

The third, CVE-2012-1823, is a PHP-CGI flaw that CVE-2024-4577 later bypassed.

Has Tenable released any product coverage for these vulnerabilities?

The following Tenable plugins are available to identify PHP installations and unsupported versions on affected systems:

Plugin ID	Name
48243	PHP Version Detection
58987	PHP Unsupported Version Detection
200476	PHP Scripting Language Installed (Windows)
216936	PHP Scripting Language Installed (Unix)

A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages for CVE-2026-109618 and CVE-2026-109619 as they're released. These links will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.

Get more information

Join Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

Vulnerabilities mentionedAll →

Key takeaways

Background

FAQ

Get more information

Related storiesshared CVEs / entities

2026-018: Critical Vulnerabilities in PHP

PHP warns admins of two critical flaws, emergency patches coming tomorrow

Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619

php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619

PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation

PHP2Shell Exploitation: Two Critical PHP Flaws Explained

PHP warns it plans to release 2 emergency patches imminently

PHP Warns of Two Critical 9.2 Security Vulnerabilities, Urges Users to Prepare for Patches

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Two Critical PHP RCE Vulnerabilities With CVSS 9.2 Score Put Web Servers at Risk

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws

PHP2Shell Vulnerability Gets a Public PoC Exploit for Security Testing

Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches

PHP2Shell: CVE-2026-109618 & CVE-2026-109619

Cloudflare Detects Early Exploitation Attempts Targeting Two Leaked PHP Vulnerabilities

Critical Vulnerabilities in PHP Require Immediate Patching

Cloudflare Warns of Active Exploitation Attempts Against Two Leaked PHP Flaws

Gcore Makes Enterprise Security Bundle Free for Public Agencies Until End of the Year

Gcore Makes Enterprise Security Bundle Free for Public Agencies Until End of the Year

PHP2Shell puts dozens of UK government services out of service

PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports

Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched

Understanding PHP2Shell: Everything You Need to Knownew

New Serious PHP Vulnerabilities Released and Patched

Amazon says PHP2Shell exploitation began 4 days before patches

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2012-1823	PHP-CGI Query String Parsing Flaw Enables Unauthenticated Remote Code Execution PHP, when the interpreter is exposed through the CGI (php-cgi) interface, mishandles query strings (CWE-20 improper input validation), allowing attackers to pass command-line switches such as -d and -s directly to the interpreter. A remote, unauthenticated attacker triggers the flaw by sending a crafted query string beginning with a dash (including URL-encoded forms) to any URL handled by php-cgi. Successful exploitation allows arbitrary code execution under the web server's privileges, as well as disclosure of script source code or phpinfo output, with no authentication required. Only deployments that invoke PHP via CGI/FastCGI (common in legacy shared hosting and bundled software stacks) are affected; PHP running as an Apache module or via PHP-FPM is not exposed. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25 with EPSS at 100%, indicating active in-the-wild exploitation; any ransomware association is not yet confirmed. Do: Upgrade PHP to at least 5.3.13/5.4.3 or, preferably, a currently supported PHP branch, and stop exposing the php-cgi binary directly by moving to mod_php or PHP-FPM. As an interim mitigation, block or rewrite requests whose query string begins with a dash (e.g., -d, -s, or URL-encoded dash characters) and review web server logs for such patterns to detect prior exploitation.	—	100%	KEV	PHP Deployments running PHP through the CGI (php-cgi) interface at the time of disclosure; per public advisories this includes versions prior to 5.3.12/5.4.2, fixed	masshundreds of thousands of internet-exposed php-cgi endpoints (a subset of the tens of millions of PHP-powered websites)	— KEV Mar 25, 2022
CVE-2019-11043	Buffer Overflow in PHP-FPM Enables Unauthenticated RCE on nginx Stacks CVE-2019-11043 is a buffer overflow (CWE-120/CWE-787) in PHP's FastCGI Process Manager (PHP-FPM) affecting PHP 7.1.x before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11. In certain FPM configurations — commonly web servers such as nginx that split PATH_INFO via fastcgi_split_path_info without validating that the requested PHP script exists — an unauthenticated remote attacker can send a crafted request that makes PHP-FPM write past allocated buffers into the space reserved for FCGI protocol data. This corruption of the FastCGI protocol state allows the attacker to execute arbitrary code with the privileges of the PHP-FPM worker on the hosting web server. Anyone running a vulnerable PHP-FPM behind an affected configuration is exposed, including Linux distribution packages (Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, Red Hat Software Collections), Tenable.sc deployments, and QNAP NAS devices running vulnerable PHP. The flaw is being actively exploited in the wild — it is in CISA's KEV with known ransomware use (including campaigns such as NextCry targeting Nextcloud instances on Linux servers) — and a public proof-of-concept exploit exists, consistent with its 99.8% EPSS score. Do: Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later (or apply your distribution's/vendor's patched packages — CISA's KEV required action is to apply updates per vendor instructions; QNAP users should apply QNAP's released updates). As an interim mitigation, harden the nginx fastcgi_split_path_info configuration (prefix the regex with '^' and use try_files to confirm the script exists) or disable PATH_INFO where it is not needed. Prioritize internet-facing web servers, shared hosting, and QNAP/Nextcloud instances for patching and check them for compromise, given active ransomware exploitation.	9.8	100%	KEV
CVE-2024-4577	OS Command Injection in Windows PHP-CGI Allows Remote Code Execution CVE-2024-4577 is an OS command injection flaw (CWE-78) in Windows-based PHP when it runs in CGI mode, allowing arbitrary code execution on the server. It is triggered when attacker-supplied characters in HTTP requests are mishandled by Windows' character-encoding conversion as the OS invokes php-cgi, letting attackers inject command-line arguments to the PHP interpreter; this bypasses the decade-old fix for CVE-2012-1823. A successful attacker gains the ability to run arbitrary commands and code in the context of the web server. Affected systems are PHP running on Windows through the CGI interface; deployments that do not use PHP-CGI on Windows are not described as affected in the source data. Exploitation is active: the flaw was added to CISA KEV on 2024-06-12 with known ransomware use, and EPSS assigns roughly 100% probability of exploitation within 30 days. Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use: upgrade Windows PHP-CGI deployments to a PHP release that fixes CVE-2024-4577 per PHP Group advisories, or stop using CGI mode on Windows (e.g., switch to FastCGI) and apply any vendor-recommended workarounds. Given known ransomware abuse, review web server access logs for exploitation attempts (notably %AD-encoded soft hyphens and injected -d/-s arguments in php-cgi query strings) and prioritize patching internet-facing Windows hosts.	9.8	100%	KEV ransomware PoC ×11
CVE-2026-109619 +1 related CVE CVE-2026-109618	PHP has various global state that temporarily points into request memory PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). NVD description · AI analysis pending	9.2	6%	PoC ×7	php php	—	1d ago