[Prawnster]

Two new major CVEs have been leaked today in PHP, potentially risking millions of websites.

They are both RCE vulnerabilities.

CVE-2026-109618 — CVSS 9.2 (Critical)
CVE-2026-109619 — CVSS 9.2 (Critical)

The early reports from researches suggest the vulnerability could allow unauthenticated attackers to execute code on targeted PHP servers.

PHP powers estimate approx. 69.3% of websites could be affected.

PHP have scheduled an emergency security release for 21st October at around 15:00 GMT+1.

Few links to sources:

Official PHP announcement:
https://www.php.net/archive/2026.php#2026-10-20-1

CERT-EU advisory:
https://cert.europa.eu/publications/secu.../2026-018/

Ars Technica:
https://arstechnica.com/security/2026/10...y-patches/

PHP usage statistics:
https://w3techs.com/technologies/cross/p...ge/ranking

There's a public PoC that's popped up but it's unverified as of right now: https://jackalsyn.com/posts/php-up-2026.html

[Money-]

After WP2Shell , things are going to be fun now.
Gotta find a working one and rewrite the POC to make it better.

[Prawnster]

After WP2Shell , things are going to be fun now.
Gotta find a working one and rewrite the POC to make it better.

Haha let me know if you do find a working PoC for sure, would be interesting to see!

EDIT: Just seen this has popped up: https://github.com/ikow/php2shell-poc

Looks like we may have a working PoC :D

[Omniscient]

Haha let me know if you do find a working PoC for sure, would be interesting to see!

EDIT: Just seen this has popped up: https://github.com/ikow/php2shell-poc

Looks like we may have a working PoC :D

Looking over that PoC now. Interesting.

[Prawnster]

Looking over that PoC now. Interesting.

Based off of what others have been testing, that's just another AI slop one instead of a functional PoC.

I believe bandors has a working PoC now?

[bandors]

I'm heading to sleep, I am sure there will be 10 more PoC when I wake up. good luck fellow defenders.

[Sift]

Based off of what others have been testing, that's just another AI slop one instead of a functional PoC.

I believe bandors has a working PoC now?

The only poc so far only manage to produce the memory corruption not a RCE chain.

---

Most of the public scripts are attempting to fetch memory offsets from the html body will be interesting once a actual working poc will be written.

[Prawnster]

The only poc so far only manage to produce the memory corruption not a RCE chain.

---

Most of the public scripts are attempting to fetch memory offsets from the html body will be interesting once a actual working poc will be written.

https://github.com/9bie/php2shell-bypass-aslr-exp

Looks like they patched it and then they've bypassed the patch? 😭

[skibidi1337]

i tried extending and using the incomplete poc script

it was close to working, but i found that it's unusable for what i wanted it for (some nasty parasites running basic wordpress sites)

http s://lime wire .com /d/GKhl8#EMx0MVbbRU

a suitable target is one which writes to $SESSION and no memory limit. most sites arent actually vulnerable to this.

full disclose: i used an uncensored llm for this, I don't know anything about php/wordpress because it's garbage so I can't answer anything else about it

[Money-]

Anyone have LFI2Shell working POC? I am sure its all over github by now but I played with 2-3 of them seem unreliable...

[▄︻デ══━一一一一━]

https://calif.io/php2shell/

For everyone to understand basics.



/*************************************/
/* ▄︻デ══━一一一一━ */
/*************************************/

[Jamika]

The situation is genuinely serious, to the point that website owners are terrified of having their sites hacked.