PHP2Shell: CVE-2026-109618 and CVE-2026-109619 Detection, Monitoring, & Reporting

On October 20, 2026, PHP (php.net) announced they would publish a security release addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP made updates available the following day, on October 21. Given the wide range of versions now vulnerable to these exploits and the widespread use of PHP in web applications, the impacts are wide. Find recommendations to protect your organization and stay up-to-date in reported exploitation of these two vulnerabilities below. 

Vulnerabilities

• CVE-2026-109618: RCE via OOM corruption. Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• CVE-2026-109619: RCE via stale global state. Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

Who is at Risk

All PHP installations serving web requests. Here is one open source list of exposed software.

Insikt Group Notes

• October 20  - PHP Urges Update Preparations Ahead of Security Release for CVE-2026-109618 and CVE-2026-109619 (VIE)
• October 21 - PHP2Shell: Technical Analysis and Alleged PoCs for Two Actively Exploited PHP Vulnerabilities, Tracked as CVE-2026-109618 and CVE-2026-109619 (TTP)

Intelligence Cards

• CVE-2026-109618
• CVE-2026-109619
• PHP (Product)

Queries

• All Insikt Group reporting on either vulnerability
• Github sources here and here
• PHP Vulnerability Monitoring for web reporting on mentions
• PHP Vulnerability Malware & Infrastructure Analysis Monitoring
• PHP Vulnerability Vendor Reporting
• Dark Web References to PHP

Recommendations

• Patches are available here. Patching is the only way to ensure full protection. 
  • However, PHP also offers additional options to reduce exposure on their site. 
  • Insikt Group posted additional recommendations in their note on October 21:  PHP2Shell: Technical Analysis and Alleged PoCs for Two Actively Exploited PHP Vulnerabilities, Tracked as CVE-2026-109618 and CVE-2026-109619.
     
• Use the vulnerability Intelligence Cards (CVE-2026-109618 and CVE-2026-109619) to track information related to the two vulnerabilities as events unfold. Consider adding them to your Vulnerability Watch List for expanded visibility over time.
   
• Read Insikt Group notes on the situation as they are published, as they often contain relevant indicators, mitigations, and recommendations to combat associated risks. 
  • You can create a new Alerting Rule based off of the link above to be notified when new Insikt Group notes are posted related to either of these CVEs.
     
• Ensure PHP (Product) is in your Tech Stack Watch List to trigger relevant alerts

• For temporary, ongoing monitoring, consider subscribing to custom alerts based on one of the queries in the list above or a custom query of your choice. 
   
• If you have access to Attack Surface Intelligence, two signatures have been added to the Signature Library to detect now out-of-date PHP versions that are vulnerable to these new exploits. These will be applied during your next full scan.
  • If you want to scan in advance, you can follow the steps in this guide: Identify and Scan Assets Running PHP
  • Review your exposures for affected versions 
  • Patch immediately where possible
  • Consider implementing guidance outlined in the Compensation Controls section of this note in situations where patching is not immediately possible
     
• Many of your third parties are going to be impacted by this widespread, critical pair of vulnerabilities. To monitor for ongoing third-party impacts:
  • Ensure your Third-Parties Watch List is up to date with your most recent list of vendors and suppliers.
  • For critical vendors related to your infrastructure, prioritize communication to better understand their mitigations and patching timelines and assess the potential impact and risks to your business.
  • To see affected third parties: Search by vulnerability in the Vulnerability Exposure tab on the Third Party Intelligence dashboard
    • This will return a list of affected suppliers running an out-of-date version of PHP that is susceptible to these vulnerabilities
    • This data will be updated weekly and should capture when your third parties patch or update their instances
      
      Pro Tip: If you use tags for the companies on your Third-Parties Watch List, you can also filter these results by matching tags. This is highly recommended given the scope of these vulnerabilities.