PHP Engine Hit by Two Critical RCE Flaws With Leaked Exploits; Scans Began 20 Minutes After Patch Release

Around October 21, 2026, two critical remote code execution vulnerabilities in the PHP engine, collectively dubbed php2shell (CVE-2026-109618 / CVE-2026-109619, both scoring CVSS v4.0 9.2), were disclosed. Details and public exploits leaked before the official patch shipped, leaving large numbers of servers exposed with no fix available — described as a major security incident affecting the code running roughly two-thirds of websites worldwide.

Confirmed

• Both vulnerabilities allow unauthenticated remote code execution and affect all PHP versions from 5.4 onward. According to technical analysis relayed by @unixterminal: CVE-2026-109618 involves incompletely initialized data left over during request initialization that the shutdown phase treats as valid; CVE-2026-109619 involves dangling pointers left in global state after request heap free, which can be triggered repeatedly.
• Per an account relayed by @neallathia, the impact spans WordPress, MediaWiki, Magento, Joomla, Laravel, and other ecosystems, with about 1.5 million servers left without a patch after the details leaked.
• Vercel disclosed in a security bulletin relayed by @cramforce that it had deployed WAF rules before the vulnerabilities went public and was actively blocking attacks.
• Per a Hunt.io tracking report shared by @cyb3rops, scanning waves targeting the flaws began just 20 minutes after the patch was released on October 21.
• On the day of disclosure (October 21), a WebAssembly-based PHP runtime vendor (mentioned twice by @MickeySteamboat) announced a systematic verification plan: reproducing production runtimes with synthetic data in isolated environments, testing request initialization, cleanup after memory failures, and cross-request scenarios.

Unconfirmed

• How the vulnerability details leaked before the patch, the leak channel, and AI's exact role remain unclear — so far only a researcher's lament that "AI is destroying responsible disclosure" (@unixterminal), with no confirmed cause published.

Why it matters

• Unauthenticated RCE combined with a pre-release exploit leak means any affected PHP service exposed to the public internet could be taken over directly — one of the largest-impact supply-chain-level security incidents in recent years.
• The incident exposes the strain responsible disclosure is under in the era of large models: details and exploit code can now be generated and spread faster than patches can be distributed.
• WASM runtime vendors seized the moment to showcase isolation advantages and run systematic verification, while developers joked that "compile to WASM and you're immune to CVEs" (@MickeySteamboat) — a side effect reflecting industry interest in alternative runtime protection paths.

2026-10-22 ~ 2026-10-23 · 6 related posts

Full story(15 episodes)→

• Episode 1: PHP Rushes Emergency Patches for Two Unauthenticated RCE Flaws Found with OpenAI Models(2026-10-21, 113 posts)
• Episode 2: Researchers Predict LLM Audits Will Uncover More PHP Vulnerabilities(2026-10-21, 3 posts)
• Episode 3: PHP RCE proof-of-concept confirmed working, but not one-click(2026-10-21, 2 posts)
• Episode 4: "Black October": A Wave of Critical Vulnerabilities Hits Dozens of Open-Source Projects(2026-10-21, 27 posts)
• Episode 5: LLM-Generated Fake PHP Exploit Sparks Security Panic(2026-10-21, 2 posts)
• Episode 6: Open-source repo demonstrates HTTP-only ASLR bypass RCE in PHP 8.4.26(2026-10-21, 2 posts)
• Episode 7: PHP Engine Hit by Two Critical RCE Flaws With Leaked Exploits; Scans Began 20 Minutes After Patch Release(2026-10-22, 6 posts)
• Episode 8: PHP 8.5.12 Patch Incomplete: php2shell Double-Free Still Exploitable(2026-10-22, 2 posts)
• Episode 9: php2shell Vulnerability Story Told in Hand-Drawn Comics(2026-10-22, 2 posts)
• Episode 10: PHP Zero-Day Rush Patch Meets ARTEX Agent Attacks in "Worst Cybersecurity Day"(2026-10-22, 28 posts)
• Episode 11: PHP2Shell Exploited Four Days Before Public Disclosure(2026-10-22, 2 posts)
• Episode 12: php2shell Exploits Top One Million After Disclosure(2026-10-22, 3 posts)
• Episode 13: Drupal/PHP Vulnerability Surge Keeps Security Teams Busy Hardening Sites(2026-10-22, 2 posts)
• Episode 14: AI-Discovered PHP2Shell Flaw Forces Global Emergency Patching(2026-10-22, 12 posts)
• Episode 15: Investor Deedy Warns AI Is Lowering the Barrier to Exploiting Vulnerabilities(2026-10-22, 3 posts)

• After PHP advisories, a WebAssembly runtime vendor lays out its security validation plan — MickeySteamboat · 2026-10-22
• [source] Two critical PHP RCE flaws get public exploits; Vercel WAF already blocking attacks — cramforce · 2026-10-22
• PHP hit by two unauthenticated RCE bugs, details leaked pre-patch, 1.5M servers exposed — neal_lathia · 2026-10-22
• Leaked PHP2Shell RCEs (CVSS 9.2) Draw Scans 20 Minutes After Patch, No Confirmed Exploits Yet — cyb3rops · 2026-10-23
• Two PHP core bugs allow unauthenticated RCE, and AI is wrecking responsible disclosure — unixterminal · 2026-10-23
• As critical PHP CVEs hit two-thirds of the web, devs joke: compile to WASM to dodge them — MickeySteamboat · 2026-10-23