Key Takeaways
- Embargoed details leaked early: Information on two purported critical remote code execution vulnerabilities in PHP core leaked on October 20, 2026, ahead of a coordinated disclosure originally scheduled for October 22. PHP advanced its release timeline forward to October 21, 2026 at 14:00 UTC.
- Purported exploit already showcased: A video attributed to Calif.io shows a POC dubbed “php2shell” achieving RCE against a current PHP 8.5.4 build in about 15 seconds. This tool is claimed to work against PHP 5.4.0 and later.
- End-of-life versions will stay exposed: Patches are expected only for 8.x versions. Hosts running end-of-life PHP versions will remain exposed and potentially vulnerable.
- Exploitation imminent: TRACE assesses exploitation as likely imminent or already occurring, with widespread opportunistic exploitation attempts expected shortly after the official patch release.
Dataminr Alert
Summary
On October 20, 2026, information about two purported remote code execution vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, was published on a forum, prior to official disclosure. The PHP security team scores both at CVSS v4 9.2, with emergency patches announced for October 21, 2026 at 14:00 UTC. This is one day ahead of the original planned disclosure date, with further acceleration of the timeline expected if technical details become public or exploitation is detected.
Version scope has not yet been officially confirmed, however, multiple third-parties have reported the vulnerabilities are believed to affect PHP 5 and later. Dataminr has observed at least 2M publicly exposed PHP-based software instances that are potentially vulnerable. However, due to hardening best practices related to redacting headers, the true magnitude of global exposure likely far exceeds this number.
A POC video attributed to security research firm Calif.io shows an exploit running against multiple leading PHP-based CMS solutions, frameworks, and applications.
Within hours of the leak, Dataminr observed multiple instances of attempts to create POC exploits, and publication of said exploits alongside detailed write-ups, though these exploits have not been independently verified.
PHP is present across a large share of the web, including many leading CMS solutions such as WordPress, Drupal, Joomla, Laravel, and Magento, as well as vendor appliances with PHP-based components. Given the leak of the CVEs, rapid publication of purported POCs, and widespread global exposure, threat actors are assessed as highly likely to imminently reproduce and mass exploit these vulnerabilities, with further acceleration expected after the patches are published.
Though no official mitigation has been provided by PHP, limited public reporting suggests the vulnerabilities may be linked to session.upload_progress.enabled, with a potential temporary mitigation to disable this via php.ini if isolation of internet-facing instances is non-viable. CERT-EU recommends isolation of all internet-facing devices running PHP.
Immediate Actions and Recommendations
- Inventory and triage internet-facing PHP now: Include CMS, vendor appliances, and any internet-facing software with PHP components. Many servers hide PHP version headers, so confirm inventory internally rather than relying on external attack surface scans.
- Patch as soon as fixes publish: Upgrade to fixed versions immediately once patches are available.
- Confirm managed and third-party hosting: For sites on managed hosting or vendor appliances, confirm the provider’s awareness and expected mitigation timeline.
- Isolate end-of-life versions: Hosts on EOL PHP versions should be upgraded, restricted to access only from trusted networks, or taken offline. Web application firewall rules may help as a stopgap, but as seen in recent months with patch bypasses targeting other technologies, may not be 100% effective in blocking all future permutations of the exploit.
- Start monitoring now, intensify hunting after patches release: Monitor for suspicious connections and activity on internet-facing web servers, and hunt for unexpected files in related directories.
2026 Mid-Year Cyber Threat Landscape Report
The first half of 2026 was defined by a widening gap between attack speed and defense speed — and AI is accelerating both sides. Dataminr’s 2026 Cyber Threat Landscape Mid-Year Report pulls from 4,500 threat actors tracked, 73,000 vulnerabilities detected, and over 2 million alerts processed per month to surface what actually mattered in H1 and what teams need to prepare for in H2.
Download Report
