PHP2Shell: Critical PHP RCE CVE-2026-109618 & CVE-2026-109619

APG SitRep: Critical PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) 

Blackpoint Adversary Pursuit Group (APG) | Category: APG SitReps Opened: October 20, 2026 | Current: UPDATE 01, October 21, 2026, 10:30 ET Severity: Critical, CVSS v4.0 9.2 | Partner action required: Yes, patch now 

Critical PHP Security Advisory

PHP has released fixes for two critical, unauthenticated remote code execution vulnerabilities. Update every PHP installation serving web requests to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now, internet facing systems first. There are no complete mitigations. Exploit code is public and early attacks are being reported. 

While temporary configuration changes may make certain exploitation methods more difficult, they do not fully address the underlying vulnerabilities and should not act as a substitute for the official PHP security updates.   

UPDATE # 02 | October 21, 2026 | 10:30 ET | Critical PHP patch released 

Situation to Date 

Following our earlier advisory, the PHP development team has released the emergency security updates. Organizations operating PHP based applications and services, including WordPress, Magento and custom web applications, should patch immediately, prioritizing internet facing systems. 

Blackpoint APG has independently validated the reported vulnerabilities and continues to monitor for exploitation activity. Temporary configuration changes may make certain exploitation methods more difficult, but they do not address the underlying vulnerabilities and are not a substitute for the official updates. 

  
CVEs CVE-2026-109618 (RCE via out-of-memory corruption), CVE-2026-109619 (RCE via stale global state) 
Severity CVSS v4.0 9.2 (Critical), unauthenticated 
Affected versions All PHP releases prior to 8.2.35, 8.3.36, 8.4.27 and 8.5.12 
Affected deployments All installations serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed. PHP rates Apache mod_php highest risk, with a demonstrated exploit that triggers before any application code runs. 
Fixed versions PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 
Unsupported versions PHP 8.1 and older receive no official packages. PHP has published source-only backports for 7.4, 8.0 and 8.1; some Linux distributions and LTS vendors are shipping backported packages. Older versions must be upgraded or isolated. PHP 8.2 reaches end of life December 31, 2026. 
Exploitation status Vendors including Cloudflare have begun reporting active exploitation; specific details have not been released. Blackpoint APG is monitoring across partner environments and has not observed activity at the time of writing. 

Actions to Date: What is Blackpoint Doing? 

  • Blackpoint APG has independently validated the reported vulnerabilities and continues to review security telemetry for activity associated with exploitation. 
  • The Blackpoint Response Operations Center (BROC) continues to monitor supported environments around the clock, investigating suspicious activity and responding to identified threats. 
  • Existing Blackpoint detections are designed to identify suspicious activity associated with exploitation and post exploitation, including web server processes spawning command shells, unexpected outbound connections and webshell creation. 

Actions to Be Completed: Recommendations 

  1. Immediate: Upgrade affected PHP installations to the fixed versions, prioritizing internet-facing applications and services and Apache mod_php deployments. 
  1. Restart PHP-FPM, Apache or equivalent after updating so the patched binary is loaded. Rebuild and redeploy container images. 
  1. Verify the version in the component serving web traffic (php-fpm -v, the Apache module, or phpinfo()), not only the command-line binary. 
  1. Identify legacy PHP installations that cannot receive updates and migrate them to supported releases. Where that is not possible today, restrict external access. 
  1. Limit access to file upload endpoints and multipart/form-data requests where they are not required for business operations. 
  1. Investigate suspicious web requests, unexpected PHP process activity and unusual child processes that could indicate exploitation or post exploitation. 
  1. Confirm that hosting providers and managed application vendors have applied the PHP updates to customer environments. 

Updating application plugins or themes alone does not replace patching the underlying PHP runtime. 

Issues, Risks, and Needed Decisions 

  • Continued exposure: Unpatched PHP installations remain vulnerable, particularly internet facing applications and services. 
  • Potential exploitation: Remain alert for suspicious activity, including compromise that may have occurred before patches were deployed. 
  • Unsupported PHP versions: Organizations on unsupported versions may need to upgrade to a supported release. 
  • Emergency patching: Partners should prioritize remediation across affected customer environments and determine whether accelerated maintenance windows are necessary. 
  • Ongoing monitoring: Blackpoint continues to assess emerging intelligence and will provide additional findings and guidance as information becomes available. 

ADVISORY | October 20, 2026 | Advance notice issued 

Situation to Date 

The PHP Security Team issued an advance warning regarding two critical vulnerabilities, each rated 9.2 under CVSS v4.0, with security updates scheduled for Wednesday, October 21, 2026, at 10:00 ET (14:00 UTC). The notice followed a leak of embargoed vulnerability details; independent researchers reported potential remote code execution. Affected versions and technical details were not yet disclosed. 

Actions to Date: What is Blackpoint Doing? 

  • APG proactively reviewed available security telemetry for suspicious activity potentially associated with these vulnerabilities and began evaluating opportunities to strengthen coverage as details became available. 
  • BROC continued around the clock monitoring of supported environments. 

Actions to Be Completed: Recommendations 

  • Identify PHP installations across infrastructure and customer environments, including WordPress, Magento and custom web applications. 
  • Prioritize internet-facing systems and prepare them for emergency updates. 
  • Coordinate with hosting providers on who deploys PHP security patches. 
  • Prepare to patch immediately on release and validate application functionality afterward. 
  • Review exposure and restrict unnecessary external access where immediate patching may not be possible. 

References 

Change log 

Date/time (ET) Change 
Oct 21, 2026, 10:30 UPDATE 01 posted. Bottom line, affected/fixed versions and recommendations revised. 
Oct 20, 2026 SitRep opened with advance-notice advisory. 

APG SitReps by email. Critical vulnerabilities and active threats with a partner action. Nothing else.

Subscribe to receive updates from Blackpoint’s Adversary Pursuit Group

DATE PUBLISHEDOctober 20, 2026
AUTHORBlackpoint Cyber

The 2AM Test

Executive Guide
Most MDR evaluations focus on dashboards, not what a provider actually does when something is live. Learn the four questions that matter more than the demo: authority, speed, surface coverage, and proof.
*88–91% of ransomware attacks land outside business hours

GET YOUR COPY