What is it?

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Evidence

• PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
  Fortinet · US · 1 d ago
• CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)
  Palo Alto Networks · US · 1 d ago
• Vulnerabilities in PHP Affecting Cisco Products: October 2026
  Cisco · US · 10 h ago

• Multiples vulnérabilités dans PHP (21 octobre 2026)
  CERT-FR · FR · 2 d ago
• [Màj] Multiples vulnérabilités dans PHP (21 octobre 2026)
  CERT-FR · FR · 2 d ago
• UPOZORENJE: Kritične ranjivosti u PHP-u – objavljene zakrpe
  CERT.hr · HR · 1 d ago
• PHP-s tuvastati kaks kriitilist turvanõrkust: süsteemihaldajatel tuleb valmistuda turvauuenduseks
  CERT-EE · EE · 1 d ago
• Kritiska sårbarheter i PHP
  CERT-SE · SE · 1 d ago
• Critical security issue affecting PHP
  NCSC UK · GB · 1 d ago
• CSIRT Panamá Aviso 2026-oct-21: Vulnerabilidad Crítica en el núcleo de PHP permite ejecución remota de código (“PHP2Shell”) — CVE-2026-109619
  CSIRT Panamá · PA · 1 d ago
• CSIRT Panamá Aviso 2026-oct-21: Vulnerabilidad Crítica en el núcleo de PHP permite ejecución remota de código (“PHP2Shell”) — CVE-2026-109618
  CSIRT Panamá · PA · 1 d ago
• NCSC-2026-0443 [1.00] [H/H] Kwetsbaarheden verholpen in PHP
  NCSC-NL · NL · 1 d ago
• Critical Remote Code Execution in Drupal Core and the Entity List Module (CVE-2026-108097 and CVE-2026-108099) – 20261020011
  BtCIRT · BT · 1 d ago
• TT-CSIRT – 462.21.10.26- Critical Remote Code Execution Vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619)
  TT-CSIRT · TT · 1 d ago
• CERTFR-2026-AVI-1359_Multiples vulnérabilités dans PHP
  AMSN Monaco · MC · 1 d ago
• Saistībā ar globāli atklātām PHP ievainojamībām Latvijā ievieš preventīvus pasākumus
  CERT.LV · LV · 1 d ago
• [Security Blog] HKCERT Warns of Critical “PHP2Shell” Vulnerabilities: Businesses Must Immediately Review and Patch PHP Systems AI Accelerates Cyber Attacks and Defence, Further Shortening the Response Window Between Vulnerability Disclosure and Exploitation
  HKCERT · HK · 1 d ago
• 2026-018: Critical Vulnerabilities in PHP
  CERT-EU · EU · 1 d ago
• AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619
  CCCS · CA · 1 d ago
• Cenueshmëri kritike në PHP: AKSK bën thirrje për përditësimin e menjëhershëm të sistemeve
  AKSK Albania · AL · 1 d ago
• Kritiskas ievainojamības PHP programmatūrā
  CERT.LV · LV · 1 d ago
• PHP Multiple Vulnerabilities
  HKCERT · HK · 23 h ago
• แจ้งเตือน พบช่องโหว่ PHP2Shell เสี่ยงถูกควบคุมเซิร์ฟเวอร์จากภายนอก
  ThaiCERT · TH · 22 h ago
• Критични уязвимости в PHP
  CERT Bulgaria · BG · 18 h ago
• Critical Remote Code Execution in PHP (CVE-2026-109618 and CVE-2026-109619) – 20261021012
  BtCIRT · BT · 18 h ago
• CVE-2026-109618 and CVE-2026-109619 affecting PHP
  NCSC NZ · NZ · 4 h ago
• Ngā whakatūpatotanga Alerts
  NCSC NZ · NZ · 4 h ago
• 21 October 2026 21 October 2026 Critical Vulnerabilities in PHP (PHP2Shell) Attackers can exploit multiple critical vulnerabilities in PHP to achieve unauthenticated remote code execution. Patch immediately. Alerts
  CSA Singapore · SG · 4 h ago
• PHP 보안취약점(PHP2Shell) 관련 기업 보안 대응 수칙
  KrCERT · KR · 4 h ago
• PHP 제품 보안 업데이트 권고
  KrCERT · KR · 4 h ago
• NÚKIB upozorňuje na kritické zranitelnosti v PHP - jediným řešením je aktualizace
  NÚKIB · CZ · 4 h ago
• Riasztás a PHP futtatókörnyezet kritikus sérülékenységeiről 2026. 10. 21.
  NKI GovCERT-Hungary · HU · 4 h ago
• 2026. 10. 22. A PHP2Shell javítások megérkeztek, de a leállások és a kihasználási kísérletek miatt még nem ért véget az incidens
  NKI GovCERT-Hungary · HU · 4 h ago
• CVE-2026-109619 Kritikus PHP, PHP Group 2026. 10. 21.
  NKI GovCERT-Hungary · HU · 4 h ago
• NKSC paskelbė DUK apie PHP kritinius pažeidžiamumus
  NKSC Lithuania · LT · 4 h ago
• Svarbi informacija apie 2026 m. spalio 21 d. planuojamą PHP programinės įrangos atnaujinimą
  NKSC Lithuania · LT · 4 h ago
• Alertă de securitate: Vulnerabilități critice identificate în PHP
  CERT-GOV-MD (STISC) · MD · 4 h ago
• Некој се обидел да ги искористи ранливостите во PHP2Shell 4 дена пред нивното јавно објавување
  MKD-CIRT · MK · 4 h ago
• НКЦКИ предупреждает об угрозе эксплуатации уязвимостей в PHP
  NKTsKI (GosSOPKA) · RU · 4 h ago
• Критичне рањивости у PHP2Shell
  SRB-CERT · RS · 4 h ago
• Kritické zraniteľnosti v PHP
  SK-CERT · SK · 4 h ago
• SI-CERT 2026-07 / Kritične ranljivosti v PHP (PHP2Shell)
  SI-CERT · SI · 4 h ago
• Complément d’alerte : Vulnérabilités critiques PHP2Shell
  maCERT (DGSSI) · MA · 4 h ago

• Horizon3 Promotes Keith Poyser to General Manager, EMEA Following More Than 260% Regional Revenue Growth
  Horizon3.ai · US · 7 d ago
• Horizon3 and Pax8 Expand Partnership to Bring Autonomous Security Testing to MSPs Across Europe
  Horizon3.ai · US · 6 d ago
• Rapid7 Intelligence Wins the 2026 Péter Szőr Award for Outstanding Research
  Rapid7 · US · 6 d ago
• Meeting the ECB’s AI-Enabled Cybersecurity Supervisory Recommendations with NodeZero®
  Horizon3.ai · US · 6 d ago
• CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
  Rapid7 · US · 3 d ago
• Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
  Rapid7 · US · 3 d ago
• Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in
  Rapid7 · US · 3 d ago
• Horizon3 expands in Singapore to accelerate AI‑native proactive security across Southeast Asia
  Horizon3.ai · US · 2 d ago
• CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE
  Horizon3.ai · US · 2 d ago
• Horizon3 Surpasses $100 Million ARR, Marking a Key Milestone in the Shift to Continuous, Production-Safe Autonomous Security
  Horizon3.ai · US · 2 d ago
• CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code Execution
  Horizon3.ai · US · 2 d ago
• Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
  Huntress · US · 1 d ago
• Major security alert: PHP vulnerable to critical RCE, attacks ongoing
  Patchstack · EE · 1 d ago
• Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days
  Rapid7 · US · 1 d ago
• PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
  Wiz · US · 1 d ago
• CVE-2026-109618 / CVE-2026-109619 | What is Known
  Horizon3.ai · US · 1 d ago
• Two critical RCEs in PHP core
  Cisco Talos · US · 1 d ago
• Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
  Kaspersky · RU · 1 d ago
• CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
  Rapid7 · US · 1 d ago
• PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
  Socket · US · 1 d ago
• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
  Palo Alto Unit 42 · US · 1 d ago
• Audit-Ready Isn’t Attack-Ready.
  Horizon3.ai · US · 1 d ago
• PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now
  Wordfence · US · 1 d ago
• PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
  Socket · US · 1 d ago
• Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
  Wordfence · US · 23 h ago
• The Current Landscape of OAuth Attacks
  Palo Alto Unit 42 · US · 7 h ago
• PHP2Shell Exposure Depends on More Than Whether You Use PHP
  Horizon3.ai · US · 5 h ago
• Unofficial backports for CVE-2026-109618 / CVE-2026-109619 to EOL PHP 7.3 (EL7) and 5.4/5.3 (Amazon Linux)
  oss-security · INT · 5 h ago
• Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
  oss-security · INT · 5 h ago
• Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
  oss-security · INT · 4 h ago
• Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
  oss-security · INT · 4 h ago
• Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
  oss-security · INT · 4 h ago
• Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
  oss-security · INT · 4 h ago
• Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
  oss-security · INT · 4 h ago
• Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
  oss-security · INT · 4 h ago
• Blog post SonarQube container scanning is now in open beta Scan the container images you build and ship for vulnerabilities and malicious packages. Included with SonarQube Advanced Security. Join the open beta. Read article
  Sonar · CH · 4 h ago
• CVE-2026-76268 | Splunk Enterprise Patroni REST API Missing Authentication Vulnerability
  Horizon3.ai · US · 4 h ago
• CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and 5.3.3 (EL6)
  oss-security · INT · 3 h ago

• Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
  Infosecurity Magazine · GB · 1 d ago
• PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
  The Hacker News · IN · 1 d ago
• PHP releases emergency fixes for 2 critical vulnerabilities
  CyberScoop · US · 1 d ago
• PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
  The Hacker News · IN · 1 d ago
• PHP ships emergency patches for critical PHP2Shell flaws
  BleepingComputer · US · 1 d ago
• ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
  Wired · US · 1 d ago
• Widespread PHP Flaw May Cause Many Site Outages Today
  Krebs on Security · US · 1 d ago
• 'PHP2Shell' Bugs Signal Red Alert for Security Industry
  Dark Reading · US · 1 d ago
• Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
  The Hacker News · IN · 17 h ago
• PHP2Shell Exploitation Started Days Before Patches
  SecurityWeek · US · 14 h ago
• PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
  Infosecurity Magazine · GB · 14 h ago
• What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
  Help Net Security · HR · 14 h ago
• New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
  Help Net Security · HR · 12 h ago
• Tech and Security Companies Respond to PHP2Shell Vulnerabilities
  SecurityWeek · US · 12 h ago
• Amazon says PHP2Shell exploitation began 4 days before patches
  BleepingComputer · US · 11 h ago

• PHP : deux vulnérabilités critiques déjà exploitées en cours de correction
  LeMagIT · FR · 1 d ago
• Critical flaws strike PHP as disclosure embargo is broken
  iTnews · AU · 1 d ago
• Global government websites go dark after security flaw revealed
  RT · RU · 1 d ago
• [PHP2Shell 파장] 세계 웹사이트 70% 쓰는 PHP, 치명적 보안 결함 발견... 정부·기업 '비상'
  Boannews · KR · 23 h ago
• [PHP2Shell 파장] 서버 장악하고 개인정보 빼간다... 예상 공격 시나리오
  Boannews · KR · 22 h ago
• [PHP2Shell 파장] AI로 협력한 보안 업계, PHP 치명적 결함 발견에 핵심 역할
  Boannews · KR · 22 h ago
• [PHP2Shell 파장] 키오스크 화면 눌렀더니 시스템 털렸다... 웹의 본체 PHP는 무엇?
  Boannews · KR · 22 h ago
• 에버스핀, ‘PHP2셸’ 원격코드실행 취약점 사전 차단... “공식 패치 전 방어망 구축”
  Boannews · KR · 21 h ago
• 팔로알토 “세계 PHP 인스턴스 2200만 개 노출... AI 기반 선제 방어 시급”
  Boannews · KR · 19 h ago
• ¿Qué es PHP y por qué generó una falla de seguridad en internet que desató una alerta global?
  El Nacional · VE · 19 h ago
• [PHP2Shell 파장] “PHP 즉시 업데이트하고 패치 후 로그 점검”... 과기정통부, 기업 대응 수칙 배포
  Boannews · KR · 18 h ago
• 스틸리언, 사이버위기 ‘주의’ 발령에 PHP 취약점 무상 진단 지원
  Boannews · KR · 18 h ago
• 티오리 “PHP 취약점, 패치가 최선”
  Boannews · KR · 17 h ago
• CISA呼籲儘速修補PHP2Shell
  iThome · TW · 17 h ago
• php2shell: Updates trudeln ein, viele Webseiten offline, Angriffe laufen
  heise · DE · 17 h ago
• 研究人員借助AI力量找出存在超過10年的資安漏洞PHP2Shell
  iThome · TW · 17 h ago
• [PHP2Shell 파장] “개인정보 유출 우려... DB 접근권한 최소화 시급”
  Boannews · KR · 16 h ago
• Alerta d'una "vulnerabilitat crítica" que pot afectar webs i serveis en línia d'Andorra
  Diari d'Andorra · AD · 16 h ago
• 금융권, PHP 취약점 긴급 보안권고... “금융사 웹 API 즉각 점검해야”
  Boannews · KR · 15 h ago
• Vulnérabilités PHP : de nombreux sites Web déconnectés par précaution
  LeMagIT · FR · 15 h ago
• Millions of hacking attempts as companies, governments rush to patch PHP flaws
  Rappler · PH · 13 h ago
• ¿Qué es PHP y por qué generó una falla de seguridad en internet que desató una alerta global?
  Prensa Libre · GT · 12 h ago
• PHP2Shell: Wie eine Server-Schwachstelle Behörden aus dem Netz kegelte
  Der Spiegel · DE · 12 h ago
• php2shell: Wer nun was machen muss
  heise · DE · 9 h ago
• PHP-Schwachstellen: Auch Geräte daheim können betroffen sein
  t-online · DE · 8 h ago
• PHP Security Flaw Sets Off Global Rush to Patch, Leaving Websites Offline
  New York Times · US · 8 h ago
• Regional cyber scare: Uganda silent as Kenya, global tech giants patch critical software bug
  Daily Monitor · UG · 6 h ago
• Sicherheitslücke betrifft drei Viertel aller Webseiten
  Liechtensteiner Vaterland · LI · 4 h ago
• Nyhet ”Miljoner” attacker mot säkerhetshålen i php Av Mikael Markander 22 okt. 2026 2 min Säkerhet
  Computer Sweden · SE · 4 h ago
• Nyhet Akuta säkerhetshål i php – sajter kan behöva stängas ner Av Mikael Markander 21 okt. 2026 1 min Säkerhet
  Computer Sweden · SE · 4 h ago
• UK orders dozens of official websites offline after flaw warnings
  The National · AE · 4 h ago
• Government agencies given 7 days to patch critical PHP flaws
  Graphic Online · GH · 4 h ago
• Cybersécurité : le CERT-MU alerte sur deux failles critiques affectant PHP
  Defimedia · MU · 4 h ago
• Singapore organisations urged to patch critical PHP flaws immediately amid cyberattack threat
  CNA · SG · 4 h ago
• Hacking attempts surge as websites race to patch PHP issues
  ABC News · AU · 4 h ago
• ¿Qué es PHP y por qué generó una falla de seguridad en internet que desató una alerta global?
  La Prensa Nicaragua · NI · 4 h ago
• PHP2Shell: una IA descubre una falla de seguridad que amenaza a millones de sitios web en todo el mundo
  La Tercera · CL · 4 h ago
• What is PHP? The AI-detected bug prompting a global security scramble
  The Globe and Mail · CA · 3 h ago
• Companies, governments rush to patch PHP flaws as hacking attempts mount
  Arab News · SA · 3 h ago

• Cloudflare deploys protections against php2shell vulnerability
  Hacker News · INT · 1 d ago
• PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
  Hacker News · INT · 1 d ago

Exploitation

• Public proof of concept
• Exploited in the wild
• Listed as known exploited

CVSS

9.2

EPSS

5.8%

First seen

1 d ago

Status

confirmed

All PHP Group vulnerabilities