+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89)
+---- Thread: [Legends] PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites (/showthread.php?tid=6334381)
PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - Prawnster - Oct 21, 2026
Two new major CVEs have been leaked today in PHP, potentially risking millions of websites.
They are both RCE vulnerabilities.
CVE-2026-109618 β CVSS 9.2 (Critical)
CVE-2026-109619 β CVSS 9.2 (Critical)
The early reports from researches suggest the vulnerability could allow unauthenticated attackers to execute code on targeted PHP servers.
PHP powers estimate approx. 69.3% of websites could be affected.
PHP have scheduled an emergency security release for 21st October at around 15:00 GMT+1.
Few links to sources:
Official PHP announcement:
https://www.php.net/archive/2026.php#2026-10-20-1
CERT-EU advisory:
https://cert.europa.eu/publications/security-advisories/2026-018/
Ars Technica:
https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/
PHP usage statistics:
https://w3techs.com/technologies/cross/programming_language/ranking
There's a public PoC that's popped up but it's unverified as of right now: https://jackalsyn.com/posts/php-up-2026.html
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - Money- - Oct 21, 2026
After WP2Shell , things are going to be fun now.
Gotta find a working one and rewrite the POC to make it better.
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - Prawnster - Oct 21, 2026
(Oct 21, 2026 02:08 AM)Money- Wrote: After WP2Shell , things are going to be fun now.
Gotta find a working one and rewrite the POC to make it better.
Haha let me know if you do find a working PoC for sure, would be interesting to see!
EDIT: Just seen this has popped up: https://github.com/ikow/php2shell-poc
Looks like we may have a working PoC :D
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - Omniscient - Oct 21, 2026
(Oct 21, 2026 02:21 AM)Prawnster Wrote: Haha let me know if you do find a working PoC for sure, would be interesting to see!
EDIT: Just seen this has popped up: https://github.com/ikow/php2shell-poc
Looks like we may have a working PoC :D
Looking over that PoC now. Interesting.
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - Prawnster - Oct 21, 2026
(Oct 21, 2026 10:32 AM)Omniscient Wrote: Looking over that PoC now. Interesting.
Based off of what others have been testing, that's just another AI slop one instead of a functional PoC.
I believe bandors has a working PoC now?
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - bandors - Oct 21, 2026
I'm heading to sleep, I am sure there will be 10 more PoC when I wake up. good luck fellow defenders.
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - Sift - Oct 21, 2026
(Oct 21, 2026 10:56 AM)Prawnster Wrote: Based off of what others have been testing, that's just another AI slop one instead of a functional PoC.
I believe bandors has a working PoC now?
The only poc so far only manage to produce the memory corruption not a RCE chain.
Most of the public scripts are attempting to fetch memory offsets from the html body will be interesting once a actual working poc will be written.
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - Prawnster - Oct 21, 2026
(Oct 21, 2026 11:32 AM)Sift Wrote: The only poc so far only manage to produce the memory corruption not a RCE chain.
Most of the public scripts are attempting to fetch memory offsets from the html body will be interesting once a actual working poc will be written.
https://github.com/9bie/php2shell-bypass-aslr-exp
Looks like they patched it and then they've bypassed the patch? π
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - skibidi1337 - Oct 21, 2026
i tried extending and using the incomplete poc script
it was close to working, but i found that it's unusable for what i wanted it for (some nasty parasites running basic wordpress sites)
http s://lime wire .com /d/GKhl8#EMx0MVbbRU
a suitable target is one which writes to $SESSION and no memory limit. most sites arent actually vulnerable to this.
full disclose: i used an uncensored llm for this, I don't know anything about php/wordpress because it's garbage so I can't answer anything else about it
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - Money- - Oct 21, 2026
Anyone have LFI2Shell working POC? I am sure its all over github by now but I played with 2-3 of them seem unreliable...
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - βοΈ»γβββδΈδΈδΈδΈβ - Oct 22, 2026
https://calif.io/php2shell/
For everyone to understand basics.
/*************************************/
/* βοΈ»γβββδΈδΈδΈδΈβ */
/*************************************/
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - Jamika - Oct 22, 2026
The situation is genuinely serious, to the point that website owners are terrified of having their sites hacked.
RE: PHP2Shell - Two PHP RCE Vulnerabilities (CVSS 9.2) ~1.3M Potentially Affected Sites - Money- - Oct 24, 2026
Right now tho , based on news. It seems no successful RCE yet , based on some SOC defense reports. Is mostly just attempts and lots and lots of scanning attempts etc...malware/shell deployment etc...
I mean ofcourse there's some group/threat actor out there with a self developed working POC and utilizing it at the moment.