CVE-2026-109618 and CVE-2026-109619: PHP flaws exploited in the wild

# CVE-2026-109618 and CVE-2026-109619: PHP flaws exploited in the wild

https://gcdradar.vercel.app/incidents/cve-2026-109618-and-cve-2026-109619-php-flaws-exploited-in-t · AIR-2026-1532 · closed 2026-11-12

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild.
- Fix status: Patched
- First reported: 2026-10-26
- AI role: No AI role
- Products: PHP, Palo Alto Networks Products
- CVE ids: CVE-2026-109619, CVE-2026-109618
- CVSS: 9.8

## Summary

Critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, are being actively exploited in the wild. Palo Alto Networks issued an advisory regarding the impact on their products.

## What to do

Upgrade PHP installations to version 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later immediately.

## Affected and fixed versions

- Affected: PHP
- Fixed in: PHP 8.5.12
- Fixed in: PHP 8.4.27
- Fixed in: PHP 8.3.36
- Fixed in: PHP 8.2.35

## Latest updates

- 2026-10-29: New reports link PHP bug exploitation to a suspected Chinese campaign targeting government affiliated servers (https://therecord.media/php2shell-successful-exploitation-reports-emerge)
- 2026-10-27: PHP releases versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fixing the critical vulnerabilities (https://cert.europa.eu/publications/security-advisories/2026-018)
- 2026-10-26: Added to the CISA KEV catalog (exploitation confirmed) (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619)
- 2026-10-26: Added to the CISA KEV catalog (exploitation confirmed) (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618)
- 2026-10-26: PHP2Shell Exploitation Moves From Probes to Working Shells (https://securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells)

## Sources

- 2026-10-26 Palo Alto Networks: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH) https://security.paloaltonetworks.com/CVE-2026-109618
- 2026-10-26 BleepingComputer: PHP2Shell security flaws now sucessfully exploited in the wild https://bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild
- 2026-10-26 SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells https://securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells
- 2026-10-26 Cisco: Vulnerabilities in PHP Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DVulnerabilities+in+PHP+Affecting+Cisco+Products%3A+October+2026%26vs_k%3D1
- 2026-10-26 CISA: CVE-2026-109618: PHP Group PHP — PHP Memory Corruption Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618
- 2026-10-26 CISA: CVE-2026-109619: PHP Group PHP — PHP Stale Internal Request-State Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619
- 2026-10-27 The Hacker News: CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html
- 2026-10-27 CERT-EU: 2026-018: Critical Vulnerabilities in PHP https://cert.europa.eu/publications/security-advisories/2026-018
- 2026-10-27 BleepingComputer: CISA confirms PHP2Shell vulnerabilities now exploited in attacks https://bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks
- 2026-10-27 The Record: CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch https://therecord.media/php-vulnerabilities-cisa-kev
- 2026-10-29 Unit 42: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619
- 2026-10-29 The Record: Limited reports of PHP bug exploitation emerge https://therecord.media/php2shell-successful-exploitation-reports-emerge

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.