Cisco Talos Tracks Two Critical PHP Core RCE Flaws Dubbed php2shell

Unauthenticated remote code execution flaws in PHP core affect builds since 5.4 and are triggered by plain HTTP requests before application code runs.

Threat Times Exposure DeskOctober 21, 20262 min read

Share LinkedIn Reddit

Cisco Talos Tracks Two Critical PHP Core RCE Flaws Dubbed php2shell — Illustration: Threat Times

Key points

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have a CVSS v4.0 score of 9.2 and allow unauthenticated remote code execution.
The flaws, dubbed php2shell, affect every PHP build since version 5.4 and are exploitable via a plain HTTP request before application logic executes.
Cisco Talos reports that artificial intelligence played a key role in the discovery of these vulnerabilities, which impact major platforms like WordPress and Drupal.

Cisco Talos researchers are monitoring the disclosure of two critical unauthenticated remote code execution vulnerabilities in the PHP core, collectively labeled php2shell. According to the threat intelligence unit, these flaws impact every PHP build released since version 5.4 and can be triggered by a standard HTTP request. The exploitation occurs before any application code runs, bypassing typical security checks at the application layer.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 score of 9.2 each. Cisco Talos notes that artificial intelligence and associated technologies were instrumental in discovering these issues, highlighting a shift in how vulnerabilities are found. This discovery method is forcing changes in patching processes for organizations due to the rapid wave of disclosures enabled by such tools.

Technical Details and Context

CVE-2026-109618 arises when out-of-memory handling interrupts PHP while internal request data is only partially initialized. According to Cisco Talos, request cleanup may then treat invalid data as valid, leading to remote code execution. The second flaw, CVE-2026-109619, occurs when a stale internal state is reused after its backing memory has been freed, before normal initialization resets it. Both issues reside in the PHP core, making them fundamental to the interpreter’s operation.

Cisco Talos has not observed these vulnerabilities being exploited in the wild as of October 21, 2026, at 14:00 UTC. However, the unit assesses that all industries running PHP applications are at risk if systems remain unpatched. State-sponsored actors, ransomware groups, and financially motivated threat actors frequently employ tactics to exploit remote code execution flaws, according to the intelligence report.

Who Is Affected

The potential blast radius extends across the entire PHP ecosystem, affecting applications running affected versions. According to Cisco Talos, platforms including WordPress, Drupal, Magento, Shopware, WooCommerce, and Laravel may be exposed. Additionally, PHP sites hosted through cPanel or Plesk are potentially vulnerable. The impact is significant because the flaw sits in the core, meaning any application relying on the affected interpreter is at risk.

PHP 8.1 and older versions are end of life, and security support for PHP 8.2 ends on December 31, 2026. Cisco Talos estimates that approximately 50% of PHP systems will not receive a patch because they run unsupported branches. The unit strongly advises immediate updates to PHP 8.2 or later for any organization running PHP 8.1 or older, noting that there is no patch available for those legacy versions.

What should you do?

Cisco Talos strongly recommends that all PHP users upgrade to available fixed releases immediately. There are no intermediate or temporary controls that provide comprehensive protection against these flaws. However, PHP advises specific measures that may reduce exposure to certain attack paths, such as adjusting memory limits and post data sizes. These mitigations are not substitutes for patching but can help limit the attack surface while updates are deployed.

Cisco customers are covered by Cisco Talos Network Intrusion Prevention (SNORT) signatures 67359 and 67360. These rules are also available in the Community Ruleset for open-source customers. Organizations should verify their detection capabilities and ensure these signatures are active to monitor for potential exploitation attempts. Continuous monitoring remains essential as the threat landscape evolves.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: PHP

Upgrade to the latest supported PHP version immediately if you are running PHP 8.1 or older, as no patches exist for those releases.
Set memory_limit=-1 in a way applications cannot override, such as using php_admin_value in FPM pool or Apache configuration, to remove controllable memory limit failures.
Configure a low post_max_size, such as 8M for applications without file uploads or 32M for those that require them, and enforce limits at the web server level.
Disable session upload progress by setting session.upload_progress.enabled=0 and restarting every worker to reduce exposure to specific attack vectors.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.