[Prawnster]

Two new major CVEs have been leaked today in PHP, potentially risking millions of websites.

They are both RCE vulnerabilities.

CVE-2026-109618 — CVSS 9.2 (Critical)
CVE-2026-109619 — CVSS 9.2 (Critical)

The early reports from researches suggest the vulnerability could allow unauthenticated attackers to execute code on targeted PHP servers.

PHP powers estimate approx. 69.3% of websites could be affected.

PHP have scheduled an emergency security release for 21st October at around 15:00 GMT+1.

Few links to sources:

Official PHP announcement:
https://www.php.net/archive/2026.php#2026-10-20-1

CERT-EU advisory:
https://cert.europa.eu/publications/secu.../2026-018/

Ars Technica:
https://arstechnica.com/security/2026/10...y-patches/

PHP usage statistics:
https://w3techs.com/technologies/cross/p...ge/ranking

There's a public PoC that's popped up but it's unverified as of right now: https://jackalsyn.com/posts/php-up-2026.html

[Money-]

After WP2Shell , things are going to be fun now.
Gotta find a working one and rewrite the POC to make it better.

[Prawnster]

After WP2Shell , things are going to be fun now.
Gotta find a working one and rewrite the POC to make it better.

Haha let me know if you do find a working PoC for sure, would be interesting to see!

EDIT: Just seen this has popped up: https://github.com/ikow/php2shell-poc

Looks like we may have a working PoC :D

[Omniscient]

Haha let me know if you do find a working PoC for sure, would be interesting to see!

EDIT: Just seen this has popped up: https://github.com/ikow/php2shell-poc

Looks like we may have a working PoC :D

Looking over that PoC now. Interesting.

[Prawnster]

Looking over that PoC now. Interesting.

Based off of what others have been testing, that's just another AI slop one instead of a functional PoC.

I believe bandors has a working PoC now?

[bandors]

I'm heading to sleep, I am sure there will be 10 more PoC when I wake up. good luck fellow defenders.

[Sift]

Based off of what others have been testing, that's just another AI slop one instead of a functional PoC.

I believe bandors has a working PoC now?

The only poc so far only manage to produce the memory corruption not a RCE chain.

---

Most of the public scripts are attempting to fetch memory offsets from the html body will be interesting once a actual working poc will be written.