php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

T1Covered by 1 source · first reported by Tenable Research at 21 Oct, 09:01 UTC

Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security…

releasessecurity

Sources

• T1php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilitiesTenable Research21 Oct, 09:01

Vulnerabilities

• CVE-2026-109618
• CVE-2026-109619