Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
The 20 October 2026, the PHP security team published a preliminary notice regarding an imminent emergency release aimed at fixing two critical vulnerabilities (both with a CVSS score of 9.2). The patches were released on Wednesday 21 October 2026. The release was accelerated after vulnerability information leaked publicly. In a Hacker News post, a user reported two remote code execution (RCE) flaws in PHP, allegedly affecting all versions from 5.4.0 onward.
The vulnerabilities in question are CVE-2026-109618 and CVE-2026-109619. At the time of publication they were reserved but not disclosed. Shortly after the article appeared, the researchersthem confirmed the existence of the vulnerabilities. Along with the leaked details, an exploit appeared online unofficially nicknamed PHP2Shell. A leaked demonstration video shows the exploit in action on web servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS, which power many modern websites. The authenticity of the demo and the exact behavior of the exploit have not been independently verified at the time of publication.
According to the researcher who published the PoC, the vulnerabilities are related to handling of multipart/form-data together with the session upload progress mechanism. The vulnerabilities reside in the PHP core and fall into the categories Use-After-Free and memory corruption. This means the flaws cannot be fixed via application code: the solution is only possible by updating PHP on the server. The attack works without authentication: a malicious user with network access to a PHP application can execute arbitrary code on behalf of the PHP process without requiring permission. The security advisories published by PHP on 21 October confirm this information.
The vulnerabilities affect PHP versions 5, 6, 7 and 8. At the time of publication, supported versions range from 8.2 to 8.5. Earlier versions, including PHP 8.1, 8.0, 7.x and 5.x, have reached end-of-life. However, due to the high severity, backport patches have also been released for versions 7.4, 8.0 and 8.1.
Meanwhile, cybersecurity researcher Kirill Firsov published a video demonstrating the PHP2Shell exploit. Saccording to his data, the exploit and video authors are the researchers lcfr_hax and calif_io. The video shows PHP2Shell executing code on test servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS.
Additionally, journalists from Ars Technica mention an unconfirmed report on the PHP2Shell issue that appeared online, for which they could not locate the original.
Sansec experts expect large‑scale attacks on the new PHP vulnerabilities could start as early as 15 minutes after the patches are released. Moreover, administrators are urged to prepare in advance for the upgrade by experts from Wordfence and Huntress, who have already issued separate warnings about PHP2Shell.
Administrators are advised to pre‑prepare a list of PHP applications and servers, create backups of sites and databases, and schedule the update immediately after the patches are released.
We strongly recommend publicly‑accessible PHP web server administrators to adopt the following measures before the patch release:
