Free PHP2Shell scanner to detect CVE-2026-109618 and CVE-2026-109619

Technical details

CVE-2026-109618 and CVE-2026-109619 are two critical remote code execution vulnerabilities in PHP core: the interpreter itself, not a framework or CMS built on top of it. Details leaked on Hacker News on October 20, 2026, two days before the planned coordinated disclosure, and the PHP security team moved its emergency release up to October 21, 2026, at 14:00 UTC.

At the time of writing, PHP has not named the vulnerable component. The leading hypothesis among researchers points to the session upload progress handler (php_session_rfc1867_callback in ext/session/session.c). PHP runs it while parsing a multipart POST request that contains a PHP_SESSION_UPLOAD_PROGRESS field, before the application script executes. The feature is enabled by default since PHP 5.4.

If that hypothesis holds, an attacker who sends a single crafted multipart request could:

• Execute arbitrary code on the server as the PHP worker user.
• Plant a webshell and move laterally to databases, stored secrets, and every other site the same server hosts.

PHP is the runtime behind a huge share of the web, including WordPress, Drupal, Joomla, Magento, cPanel, Plesk, and internal tools nobody remembers deploying. A remote code execution flaw in PHP core doesn't affect one application; it potentially affects every application PHP serves.

How we detect CVE-2026-109618 and CVE-2026-109619

Version fingerprinting alone is tricky for these CVEs, for two reasons. It can:

• understate risk (many production servers hide the PHP version in their response headers) and
• overstate it (Linux distributions often backport security fixes without changing the upstream version string).

Products affected by CVE-2026-109618 and CVE-2026-109619

The vulnerabilities live in PHP core, so every PHP deployment is in scope until the official advisory narrows the range. Unverified reports claim every version from PHP 5 onward is affected; PHP will publish the confirmed affected and fixed versions with its security release.

As things stand, the following branches are relevant:

PHP only ships fixes for its four supported branches (8.2 through 8.5). Anything older, including 8.1, 8.0, 7.x, and 5.x, is end of life and gets no vendor patch. Unofficial fixed version numbers are already circulating; ignore them until PHP publishes its own.

Note: if you run a Linux distribution's PHP packages, check your distro's security tracker as well. Backported fixes may land without the version number changing the way you expect.

PHP also hides inside vendor appliances, Windows software that bundles php.exe or php-cgi.exe, and control panels like cPanel and Plesk. These deployments need separate inventory and patching, so updating your primary web servers is not sufficient if embedded copies remain.

CVE-2026-109618 and CVE-2026-109619 severity

The PHP security team rates both vulnerabilities CVSS v4.0 base score of 9.2 (Critical). The leaked post claimed a CVSS of 10.0, but PHP's own rating is 9.2.

The high scores reflect three factors coming together:

• No authentication required: CERT-EU reads the scores as pointing to unauthenticated remote code execution.
• No user interaction required: nobody on the victim side needs to click anything or take any action.
• Broad attack surface: the flaw is in the PHP runtime, so it reaches every application built on it, and the suspected trigger is a feature enabled by default.

Put together: any unpatched, internet-facing PHP server is potentially one HTTP request away from remote code execution. That's the practical summary to bring to leadership.

How attackers exploit PHP2Shell

Based on what is known so far:

• No credentials required: reported as unauthenticated exploitation.
• No user interaction required: the attacker does not need to trick anyone into clicking a link.
• Remotely exploitable: the suspected trigger is a plain multipart HTTP request. watchTowr says it reproduced CVE-2026-109618.
• Public PoC: a short exploitation video was briefly posted online and then removed (Huntress), and an unverified PoC bundle is reportedly circulating (Phoenix Security).

The real-world impact of a successful exploit is severe. Once attackers run code as the PHP worker user, they can:

• read and modify every file in the web root
• pull database credentials straight out of application config files
• deploy webshells or malware for persistent access
• pivot to other sites and services on the same server.

History suggests the window will be short. When CVE-2024-4577, a PHP flaw in CGI mode on Windows, went public in June 2024, exploit attempts hit honeypots within 24 hours.

CVE-2026-109618 and CVE-2026-109619 disclosure timeline

How to mitigate CVE-2026-109618 and CVE-2026-109619

The only complete remediation is upgrading PHP to a fixed version. The official advisory is available from PHP. Given that details leaked before the patch and a PoC is reportedly circulating, you may want to treat this as an emergency patch based on your infrastructure and business context.

Upgrade path:

• PHP 8.2, 8.3, 8.4, and 8.5: upgrade to the fixed release for your branch.
• PHP 8.1 and older: upgrade to a supported branch. If you can't, take the system off the internet or put it behind a VPN or web application firewall until you can.
• Distro and hosting packages: check your Linux distribution and hosting provider for backported fixes, then verify with php -v that every host actually moved.
• Audit vendor appliances, control panels, Windows software, and container images separately: embedded PHP copies require independent patching.

If you cannot update immediately, apply these temporary controls, but understand they are not fixes:

• Set session.upload_progress.enabled = Off in the php.ini your web server actually uses (PHP-FPM or Apache, not the CLI one), then reload the service. Uploads keep working; only progress tracking stops.
• Isolate internet-facing PHP applications from public networks until a fix is available, as CERT-EU recommends.
• Monitor what PHP spawns. Alert on php-fpm, php-cgi, httpd, or apache2 launching shells, interpreters, or download tools. Florian Roth's free process-watcher gives you that visibility on Linux servers without endpoint detection.

Note: the upload-progress setting is based on a researcher hypothesis, not on official guidance. GMO Flatt Security and other researchers report it blocks only one of the two bugs, and PHP has published no workaround. Patching is the only reliable fix.

CVE-2026-109618 and CVE-2026-109619 references

• Pentest-Tools.com Vulnerability & Exploit Database - CVE-2026-109618
• PHP security team - upcoming critical PHP security release
• CERT-EU - Security Advisory 2026-018
• watchTowr - PHP remote code execution FAQ
• Huntress - rapid response on php2shell
• Sansec - critical PHP RCE research
• The Hacker News - PHP2Shell coverage
• NVD - CVE-2026-109618
• NVD - CVE-2026-109619

Our Network Vulnerability Scanner is a well-rounded tool for all your network security assessments.

It combines multiple engines and fine-tuned scan settings that surface more than 17,000 vulnerabilities, misconfigurations, and outdated services.

Each scan automatically updates your attack surface and provides an up-to-date map for planning targeted attacks or strategic lateral movements.

Explore a sample report which includes a vulnerability summary, automatically confirmed findings, evidence, and more.

In a transparent benchmark, our tool outperformed the 6 most popular network scanners on the market, both open-source and commercial.