PHP2Shell: two 9.2-rated holes in the PHP core, millions of exploit attempts in a day
CVE-2026-109618 and CVE-2026-109619 give remote code execution in PHP from version 5.4 onwards. Patches shipped on 21 October, details leaked a day early. A third flaw is still unpatched.
On 21 October PHP shipped emergency releases closing two vulnerabilities already nicknamed PHP2Shell. Both are rated 9.2 out of 10 and allow unauthenticated code execution on the server. Every version from 5.4 onwards is affected, which is practically every PHP site on the internet.
The release was moved forward by a day: details appeared in the open on 20 October, ahead of the agreed disclosure date. The leak quoted a 10.0 score, PHP officially assigned 9.2. For an admin the difference is academic.
By 22 October watchTowr and others were seeing exploitation in the wild, with attempts running into the millions. On 23 October a warning about a third flaw, CVE-2026-115560 in session-based upload progress tracking, was published. There is no fix for it yet.
The detail people miss: you have to update the interpreter, not the site. A host with “automatic WordPress updates” will not save you if its PHP is old.
Source: The Hacker News