php2shell (CVE-2026-109618 / CVE-2026-109619): PHP Pre-Auth RCE PoC, Source Patch & Comprehensive Defense Guide

CVE

CVE-2026-109618

Vendor

PHP

Product

PHP

Affected versions

< 8.5.12, < 8.4.27, < 8.3.36, < 8.2.35, 5.x-8.1 (EOL)

CVSS

9.2

Published

2026-10-21 08:31

Collected

2026-10-21 16:16

---
id: 10270
title: "php2shell (CVE-2026-109618 / CVE-2026-109619): PHP Pre-Auth RCE PoC, Source Patch & Comprehensive Defense Guide"
cve: CVE-2026-109618
cvss: 9.2
severity: critical
vendor: "PHP"
product: "PHP"
affected_versions: "< 8.5.12, < 8.4.27, < 8.3.36, < 8.2.35, 5.x-8.1 (EOL)"
source_domain: github.com
source_url: "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC"
published_at: "2026-10-21T08:31:43Z"
tags: ["rce", "github", "pre-auth", "poc", "defense", "uaf", "php2shell", "cve-2026-109618"]
phying_url: "https://phying.com/item/10270"
lang: en
---

# php2shell (CVE-2026-109618 / CVE-2026-109619): PHP Pre-Auth RCE PoC, Source Patch & Comprehensive Defense Guide

## Summary

# php2shell — CVE-2026-109618 / CVE-2026-109619 > **Critical Advisory (CVSS v4.0: 9.2 - Critical):** On October 20, details of two pre-auth Remote Code Execution (RCE) flaws in the PHP core leaked...

## Why it matters

Provides critical stopgap mitigations, source-level patches, and multi-web-server WAF rules for teams securing PHP deployments, especially for unpatched legacy and end-of-life installations.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-109618
- **CVSS:** 9.2
- **Vendor:** PHP
- **Product:** PHP
- **Affected versions:** < 8.5.12, < 8.4.27, < 8.3.36, < 8.2.35, 5.x-8.1 (EOL)
- **Published:** 2026-10-21T08:31:43Z
- **Original:** https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
- **Phying News:** https://phying.com/item/10270