PHP has released security updates to address two critical unauthenticated remote code execution (RCE) vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, both carrying CVSS v4.0 scores of 9.2. Successful exploitation can result in remote code execution as the web worker account and is rated high for confidentiality, integrity and availability.
PHP impact and affected versions
Affected php-src versions are those earlier than 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Patched releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The vulnerabilities allow unauthenticated RCE as the web worker account; an attacker may access data processed by the PHP worker, modify or destroy data and plant persistent backdoors, or disrupt system operations.
Immediate recommended actions
PHP Security strongly recommends updating PHP immediately to the patched release matching your 8.x branch: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. The vendor states the update is the only complete mitigation for both vulnerabilities. For users on earlier PHP versions (<8.1), minimal source backports are available for PHP 7.4, 8.0 and 8.1 to assist those building from source. PHP’s security bulletin lists partial mitigations that reduce some exposure but are not considered replacements for a proper patch update.
Updates and related advisory
UPDATE (Oct. 23): PHP released a session.upload_progress.enabled=0 setting when the earlier CVE was published on 21 October 2026. PHP released an advisory (23 October 2026) for CVE-2026-115560, a separate RCE vulnerability in session upload progress handling that shares the same mitigation as CVE-2026-109619. The advisory notes no further action is needed if you already applied the recommended setting when the earlier CVE was published on 21 October 2026. The PHP team is handling CVE-2026-115560 in the regular release cycle because the RCE requires an unlikely runtime switch of the session serialize handler within application code, making network-level detection difficult until the full advisory is published alongside the next release.
UPDATE (Oct. 22): TrendAI has released an online tool (PHP2Shell — See the Risk. Own the Response) that allows users to identify potential PHP2Shell exposure and take the next step with guidance from TrendAI security experts.
TrendAI protections, detections and impacted products
TrendAI has published multiple protections and detection capabilities to supplement vendor patches. Vision One users can view updated information under Cyber Risk Exposure Management > Cyber Risk Overview > Exposure Overview. TrendAI added background material to the Vision One Threat Intelligence Hub, including TTPs, risk-management guidance and threat-hunting queries.
TrendAI Vision One XDR monitoring workbenches include detections labelled High (e.g., “PHP based Command Execution Attack”, “Possible Webshell Activity with Base64 Encoded Payload via PHP”, “Web Shell Credential File Access via PHP CGI Process”) and Medium-Low (e.g., “Potential Command Execution via PHP Webshell”, “Shell Command Execution via PHP-FPM”). Additional FRM workbenches reference vulnerable PHP container image tags and PHP worker processes spawning shells or interpreters.
Detection rules and filters published by TrendAI include:
– Vision One Endpoint Security IPS Rules: Rule 1012749 – PHP Application Remote Code Execution Vulnerability; Rule 1012754 – PHP Application Remote Code Execution Vulnerability (CVE-2026-109619 & 2026-109618).
– Vision One TippingPoint: Filter 48514 (Security Policy) – Sec Optimized enabled; Filter 48534 – HTTP: PHP Core Upload Progress Use-After-Free Vulnerability.
– Vision One Network Detection and Response (formerly Deep Discovery Inspector): Rule 6021 – CVE-2026-109618 – PHP Zend HashTable Remote Code Execution Exploit – HTTP (Request); Rule 6023 – CVE-2026-109619 – PHP File Upload Exploit (HTTP) – Request.
– Vision One Container Security (Falco rules): TM-00000171 – (T1610) Vulnerable PHP Container Image Tag (medium); TM-00000170 – (T1190) PHP Worker Process Spawning Shell Or Command Interpreter (high).
TrendAI has initiated an urgent assessment of TrendAI products and services that may be impacted and referenced a customer advisory titled: CUSTOMER ADVISORY: Critical PHP Vulnerabilities and Impact on TrendAI Products (CVE-2026-109618 and CVE-2026-109619).
What to monitor
Organisations should prioritize patching to the listed patched releases and, until patched, monitor for the specific detection signatures and workbench alerts listed above, and consider running TrendAI’s PHP2Shell assessment if applicable.
