CVE-2026-109619

Description

A critical vulnerability has been discovered in PHP that will be addressed in a Critical PHP Security Release on October 21, 2026. Full details have not yet been shared, but public reporting from several trusted sources indicates this is one of the two CVEs that will be included in this release. When this flaw is chained with another PHP vulnerability, attackers could gain remote code execution. The chain has been dubbed php2shell by researchers at Calif. This description will be updated once PHP publishes full details.

References

https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/

Details

Source: Mitre, NVD

Named Vulnerability: php2shell

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest