[CVE-2026-109618&CVE-2026-109619] No Login Required: Inside PHP2Shell, the 9.2-Severity Bug That …

1 / 3

[CVE-2026-109618&CVE-2026-109619] No Login Required: Inside PHP2Shell, the 9.2-Severity Bug That Let Anyone Take Over Your Server

DEV Community: php·GUIDANCE WHITE·3 days ago

Reading 0:00

15s threshold

1. What is PHP2Shell?

Item Detail

Nickname PHP2Shell

CVE IDs CVE-2026-109618, CVE-2026-109619

Disclosure date October 21, 2026 (official PHP security team announcement)

CVSS score 9.2 each (CVSS v4.0, critical)

Vulnerability class Unauthenticated Remote Code Execution (RCE)

Trigger point Before any application code runs — during PHP's own request-parsing stage

Blockable by auth? No — it fires earlier than any authentication logic

Affected PHP 5.4 through 8.5

Affected runtimes Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed — any PHP runtime that serves HTTP requests

Representative affected software WordPress, Magento, Drupal, Joomla, MediaWiki, Roundcube, phpMyAdmin, Nextcloud, Laravel, and more

Exploited in the wild?…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.