{
  "name": "PHP2Shell",
  "cves": [
    "CVE-2026-109618",
    "CVE-2026-109619"
  ],
  "cvss": {
    "version": "4.0",
    "score": 9.2
  },
  "statusAsOf": "2026-10-21T13:45:00Z",
  "fixReleased": true,
  "release": {
    "scheduledAt": "2026-10-21T14:00:00Z",
    "published": true,
    "publishedAt": "2026-10-21T13:37:00Z"
  },
  "supportedBranches": [
    "8.2",
    "8.3",
    "8.4",
    "8.5"
  ],
  "branches": [
    {
      "branch": "8.2",
      "lastBeforeFix": "8.2.34",
      "affected": "8.2.34 and older",
      "fixedIn": "8.2.35"
    },
    {
      "branch": "8.3",
      "lastBeforeFix": "8.3.35",
      "affected": "8.3.35 and older",
      "fixedIn": "8.3.36"
    },
    {
      "branch": "8.4",
      "lastBeforeFix": "8.4.26",
      "affected": "8.4.26 and older",
      "fixedIn": "8.4.27"
    },
    {
      "branch": "8.5",
      "lastBeforeFix": "8.5.11",
      "affected": "8.5.11 and older",
      "fixedIn": "8.5.12"
    }
  ],
  "endOfLife": {
    "note": "PHP 8.1 and older get no official release. PHP published minimal source patches for 7.4, 8.0 and 8.1, and some distributions and LTS vendors ship backports.",
    "lastBranch": "8.1",
    "lastRelease": "8.1.34",
    "lastReleaseDate": "2025-12-18"
  },
  "sources": [
    {
      "name": "PHP: Security advisory, critical remote code execution vulnerabilities, update now",
      "url": "https://www.php.net/archive/2026.php#2026-10-21-5",
      "date": "2026-10-21"
    },
    {
      "name": "PHP: GHSA-w8hw-w9fx-j79w (CVE-2026-109618)",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
    },
    {
      "name": "PHP: GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    },
    {
      "name": "PHP: ChangeLog for 8.x",
      "url": "https://www.php.net/ChangeLog-8.php"
    },
    {
      "name": "PHP: Upcoming Critical PHP Security Release",
      "url": "https://www.php.net/archive/2026.php#2026-10-20-1",
      "date": "2026-10-20"
    },
    {
      "name": "PHP: Supported versions",
      "url": "https://www.php.net/supported-versions.php"
    },
    {
      "name": "PHP: releases feed (JSON)",
      "url": "https://www.php.net/releases/index.php?json&version=8.3"
    },
    {
      "name": "Huntress: php2shell, leaked critical PHP vulnerabilities",
      "url": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities"
    },
    {
      "name": "Sansec: Critical PHP RCE, CVE-2026-109618 and CVE-2026-109619",
      "url": "https://sansec.io/research/php2shell"
    },
    {
      "name": "CloudLinux: package availability for CVE-2026-109618 and CVE-2026-109619",
      "url": "https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability"
    },
    {
      "name": "docker-library/wordpress: the php8.3 fpm Dockerfile",
      "url": "https://github.com/docker-library/wordpress/blob/master/latest/php8.3/fpm/Dockerfile"
    },
    {
      "name": "php-src: php.ini-production (expose_php = On)",
      "url": "https://github.com/php/php-src/blob/master/php.ini-production"
    },
    {
      "name": "nginx: fastcgi_hide_header",
      "url": "https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_hide_header"
    },
    {
      "name": "Eye Security: wp2shell defender's guide",
      "url": "https://labs.eye.security/wp2shell-defenders-guide/"
    }
  ],
  "page": "https://arvion.ai/tools/php2shell"
}