Sources and national advisories
The official pages about PHP2Shell, in one list: the PHP project, the CVE records, the researchers, national CERTs and government agencies, and Linux distributions. We list no press articles.
Last reviewed . Rules of .
We opened each link on 2026-10-23. On that date each advisory page loaded and named CVE-2026-109618, CVE-2026-109619 or both. The PHP ChangeLog names the two GHSAs, and the KEV catalog lists neither CVE. Some pages need JavaScript (cve.org, NVD, NCSC-NL, BSI, Rocky Linux). For those, we read the same record in the machine-readable data that the publisher makes available.
Agencies update their pages. A later version can say more than we quote here. Read the linked page before you decide.
PHP project
The primary sources. The PHP project says that only an update is a complete solution.
- php.net: Security advisory, "Critical remote code execution vulnerabilities, update now", 21 October 2026
- php.net: "Upcoming Critical PHP Security Release", 20 October 2026. The advance notice. It rates both flaws CVSS v4.0 9.2.
- php.net release posts, 21 October 2026: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, PHP 8.2.35
- php.net: PHP 8 ChangeLog. It lists the fix as "Avoid state corruption via bailout".
- php-src: GHSA-w8hw-w9fx-j79w, "RCE via OOM corruption" (CVE-2026-109618), Critical, 21 October 2026
- php-src: GHSA-6wmf-4rv5-p3rp, "RCE via stale global state" (CVE-2026-109619), Critical, 21 October 2026
- php-src release tags: php-8.5.12, php-8.4.27, php-8.3.36, php-8.2.35
- oss-security mailing list, posts by Jakub Zelenka of the PHP security team, 21 October 2026: CVE-2026-109618, CVE-2026-109619
- The PHP Foundation: "Today's PHP Security Release, and How We're Strengthening PHP Security", 21 October 2026
Checked 2026-10-23.
CVE records
The PHP project is the CVE Numbering Authority (CNA) for both CVEs. It published both records on 21 October 2026.
| CVE | CNA score (PHP) | NVD score | Records |
|---|---|---|---|
| CVE-2026-109618 | CVSS v4.0 9.2, Critical | CVSS v3.1 9.8, Critical | cve.org, NVD |
| CVE-2026-109619 | CVSS v4.0 9.2, Critical | CVSS v3.1 8.1, High | cve.org, NVD |
- Two scores. The 9.2 is the PHP project's own CVSS v4.0 score. NVD adds its own CVSS v3.1 score. The two use different CVSS versions, and NVD makes its own assessment, so the numbers differ.
- Weaknesses. Both records list CWE-416 (use after free), CWE-755, CWE-824, CWE-1325 and CWE-1419.
- Credits. The records credit Ryan at Calif.io, Wiz and OpenAI as finders or reporters. They credit Arnaud Le Blanc, Ilija Tovilo, Jakub Zelenka and Nora Dossche for the fix. See also the credits on our explainer.
- CISA data. CISA added SSVC data to both records. See Exploitation status.
Checked 2026-10-23.
Researchers
- php2shell.com, the researchers' site, run by Wiz. It names Wiz Research, OpenAI Codex Security and Calif for the research and disclosure.
- Wiz Research: technical write-up, 21 October 2026
We left out the write-up by OpenAI, because we could not open it on the check date.
Checked 2026-10-23.
National CERTs and government agencies
Advisories that name the PHP2Shell CVEs, sorted by date of first publication. Some agencies updated their page later.
In your language: Spanish: INCIBE-CERT. French: CERT-FR and the Centre canadien pour la cybersécurité. Dutch: NCSC-NL. Italian: ACN / CSIRT Italia. German: BSI and CERT.at.
| Agency | Country | Language | Date | Advisory |
|---|---|---|---|---|
| ACN / CSIRT Italia | Italy | Italian | 2026-10-21 | PHP2Shell: sanate vulnerabilità critiche in PHP |
| BSI / CERT-Bund | Germany | German | 2026-10-21 | WID-SEC-W-2026-4055, rated kritisch. The machine-readable version gives 2026-10-20 22:00 UTC. |
| Canadian Centre for Cyber Security | Canada | English, French | 2026-10-21 | AL26-026: English, français |
| CERT.at | Austria | German | 2026-10-21 | Kritische Sicherheitslücken in PHP - Updates verfügbar |
| CERT-EU | European Union | English | 2026-10-21 | Security Advisory 2026-018, version 1.1 |
| CERT-FR (ANSSI) | France | French | 2026-10-21 | CERTFR-2026-ALE-014. Updated 2026-10-22. |
| CERT.LV | Latvia | Latvian | 2026-10-21 | Kritiskas ievainojamības PHP programmatūrā. Updated 2026-10-22. |
| CERT-SE | Sweden | Swedish | 2026-10-21 | Kritiska sårbarheter i PHP |
| CIRCL | Luxembourg | English | 2026-10-21 | TR-102, version 1.1 |
| CISA | United States | English | 2026-10-21 | Critical Vulnerabilities in PHP Require Immediate Patching |
| Cyber Security Agency of Singapore | Singapore | English | 2026-10-21 | AL-2026-151. Updated 2026-10-22. |
| INCIBE-CERT | Spain | Spanish | 2026-10-21 | Múltiples vulnerabilidades en PHP (INCIBE-2026-762) |
| NCSC-NL | Netherlands | Dutch | 2026-10-21 | NCSC-2026-0443, Kwetsbaarheden verholpen in PHP |
| NCSC | United Kingdom | English | 2026-10-21 | Critical security issue affecting PHP |
| HKCERT | Hong Kong | English | 2026-10-22 | PHP Multiple Vulnerabilities |
| JPCERT/CC | Japan | Japanese | 2026-10-22 | JPCERT-AT-2026-0033 |
| NCSC | New Zealand | English | 2026-10-22 | CVE-2026-109618 and CVE-2026-109619 affecting PHP. Updated the same day. |
Two lists from European CERTs go further:
- NCSC-NL: operational information and a software status list, for products that contain PHP
- CSIRTs Network (ENISA): CNW-2026-04, with links to the alerts of other EU CSIRTs
Checked 2026-10-23.
Exploitation status, as reported
The sources differ. Each row quotes one government or CERT source with its date. The statements are theirs, not ours. We checked them on 2026-10-23. A newer version of a page can say something different.
| Source | Date | What the source says |
|---|---|---|
| CISA alert | 2026-10-21 | "CISA has not observed exploitation of these vulnerabilities as of the time of publication" |
| CISA SSVC data in the CVE records | 2026-10-21 | Exploitation: none. Automatable: no. Technical impact: total. The same for both CVEs. |
| CISA KEV catalog | 2026-10-23 | Neither CVE is in the Known Exploited Vulnerabilities catalog (catalog version 2026.10.21). |
| Canadian Centre for Cyber Security | 2026-10-21 | The Cyber Centre "has observed open-source reporting indicating that a Proof of Concept (PoC) is available, with no active exploitation being identified at this time" |
| CERT-EU | 2026-10-21 | "initial proofs of concept (PoCs) have begun to circulate. This raises the likelihood that attackers are already exploiting the vulnerabilities." |
| CERT-FR | 2026-10-22 | CERT-FR knows of proofs of concept for both CVEs, for specific PHP deployments (our translation). |
| Cyber Security Agency of Singapore | 2026-10-22 (page update) | "There have been reports of widespread exploitation attempts targeting these vulnerabilities, as well as the development of multiple proof-of-concept (PoC) exploits." |
| NCSC New Zealand | 2026-10-22 | "The NCSC is aware of reports of active exploitation." |
| HKCERT | 2026-10-22 | "CVE-2026-109618 and CVE-2026-109619 is being exploited in the wild." |
The php.net advisory names "a demonstrated exploit" against mod_php. It does not say whether attackers use the flaws.
Our advice Do not wait for the sources to agree, or for a KEV listing. Update PHP now, and restart every PHP worker. A missing report about attacks does not show that a site was not attacked. See Check your logs.
Checked 2026-10-23.
Linux distributions
Our Linux pages have the fixed package versions and the commands. This table links each vendor's tracker.
| Distribution | Vendor tracker | Our guide |
|---|---|---|
| Ubuntu | USN-8948-1, CVE-2026-109618 | Ubuntu |
| Debian | DSA-6574-1, CVE-2026-109618 | Debian |
| Red Hat Enterprise Linux | RHSB-2026-013, CVE-2026-109618 | RHEL, AlmaLinux, Rocky |
| AlmaLinux | Announcement of 2026-10-21 | RHEL, AlmaLinux, Rocky |
| Rocky Linux | RLSA-2026:87070 (other RLSAs on our guide) | RHEL, AlmaLinux, Rocky |
| Alpine Linux | Security database v3.24 (other releases on our guide) | Alpine |
| SUSE | CVE-2026-109618 | — |
| Arch Linux | ASA-202610-1 | — |
| Amazon Linux 2 | ALAS2PHP8.2-2026-015 | — |
| Gentoo | Bug 984631 | — |
See also Fixed PHP packages on Linux, with all distributions on one page.
Checked 2026-10-23.
How we pick sources
- Only official pages: the PHP project, the CVE Program and NVD, the researchers, national CERTs and government agencies, and the vendors themselves.
- No press articles, no social media and no vendor marketing.
- We left out pages that we could not open on the check date.
- Found a wrong or broken link? Write to security@php2shell.fyi.
Check your site
Find out which PHP version your site reports to visitors. Check my site.