PHP2Shell: Two Critical Unpatched PHP RCE Vulnerabilities (CVSS 9.2) Trigger Emergency Security Alert

Swati KhandelwalOctober 21, 2026Vulnerability / Web Security

PHP will release an off-cycle security release at 2:00 p.m. UTC today, October 21, for two critical vulnerabilities that its security team rated 9.2 on the CVSS v4.0 scale but did not describe.

Security researchers at watchTowr say both flaws allow remote code execution. Only the four supported PHP branches, 8.2 to 8.5, can receive the patch, and no exploits have been reported so far.

The notice followed a leak. On October 20, an article on HN indicated that two PHP remote code execution vulnerabilities, classified as CVSS 10.0 and affecting versions starting with PHP 5, would be disclosed on Thursday, October 22. The poster said they had “no evidence beyond ‘Source: Trust Me Bro’.”

watchTowr then posted to

PHP released its advisory that evening, at 7:33 p.m. UTC, with release scheduled for Wednesday, a day ahead of the date listed by watchTowr. The advisory states that PHP could be released sooner “if the details of any of the vulnerabilities become public or if evidence of active exploitation appears in the wild.”

The leak focused on the existence of the flaws, a score, a date and two CVE identifiers, and not on how the flaws worked. The CVSS 10.0 figure is the leak figure. PHP’s rating is 9.2 on version 4.0 of the scale.

Identifiers used by researchers, CVE-2026-109618 And CVE-2026-109619were also listed in the leaked message. PHP’s notice names neither. The claim that all versions since PHP 5 are affected is also unconfirmed: watchTowr’s own FAQ on the flaws states that the scope “has not been confirmed by official vendor advisory” and that no configuration or functionality requirements have been described.

PHP says “All details, affected versions and fixed versions will be posted with the release.” Researchers began calling the pair php2shell. The name is theirs, not PHP’s.

Regardless of the affected range, PHP releases patches only for its four supported branches and records changes to each branch in its changelog. Versions 8.2 and 8.3 are only receiving security fixes, and versions 8.4 and 8.5 are in active support.

Anything older, including 8.1, 8.0, 7.x, and 5.x, is end-of-life and not receiving any PHP fixes. If the flaws reach these branches, installations on them will not have any vendor patches.

Security firm Mallory counted approximately 884,000 Internet hosts whose HTTP banner reported a PHP 8.1 or earlier version to the Shodan search engine on October 20, or 59% of the approximately 1.5 million hosts reporting a version. The count covers banners, unconfirmed affected systems, and another 740,000 hosts reported PHP as no version.

PHP has not released any workarounds. Preparation until release boils down to six steps, most taken from a Huntress rapid response post, plus isolation advice from CERT-EU.

1. Inventory every PHP installation, including PHP that comes with vendor appliances, Windows software, and control panels such as cPanel and Plesk.
2. Be ready to upgrade at 2:00 PM UTC. Patch internet-connected systems first and check with your Linux distribution and hosting provider for backported packages.
3. On an end-of-life branch, upgrade, remove the system from the internet, or put it behind a VPN or web application firewall until you can.
4. When patching cannot be done immediately, CERT-EU advises you to “consider isolating Internet applications from public networks until a patch is available.”
5. Watch what PHP starts. Alert on php-fpm, php-cgi, httpd or apache2 launching shells, interpreters or download tools. On Linux servers without endpoint detection, Florian Roth’s process observer logs every program started by a PHP process, along with its command line. He only sees a program once it’s started and, in Roth’s words, “doesn’t stop anything.”
6. If you find anything, isolate the server, keep the web server and PHP logs, and check for web shells, new files at the web root, new cron jobs, scheduled jobs, and accounts.

Huntress said it had not seen exploitation of the vulnerabilities in its partner environments as of October 20, had not built or replicated a proof of concept, and was not aware of public exploit code. The watchTowr FAQ lists the exploit as unreported as of October 21 and the flaws as not in CISA’s catalog of known exploited vulnerabilities.

For comparison, when CVE-2024-4577, a CGI-mode PHP flaw on Windows, became public in June 2024, Akamai saw exploitation attempts against its honeypot servers within 24 hours.

The release should clarify what the advisory held: which versions are affected, what part of PHP is involved, whether an attack requires a particular way of running PHP, configuration or login, and how PHP itself describes the flaws. At the time of writing, PHP has not released the fixes.