Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619
by Sansec Forensics Team
Published in Threat Research − October 21, 2026
PHP fixes two critical vulnerabilities on October 21 at 14:00 UTC. They affect all web servers running PHP 5.4 or later. You need to fix them at the infrastructure level. Sansec expects mass attacks within 15 minutes of the release.
PHP will release a fix for two critical vulnerabilities on Wednesday October 21 at 14:00 UTC (16:00 CEST, 10:00 EDT). The PHP security team rated both CVSS v4.0 9.2. A screenshot of an exploit tool named PHP2Shell, credited to Calif.IO, leaked alongside the advisory. Its banner claims the tool works against every PHP release from 5.4.0 on. The bugs affect all web servers running PHP 5.4 or later, which includes Magento, Shopware and WooCommerce stores.
We expect mass attacks to start within 15 minutes of the release.
What we know
Information about the embargoed bugs leaked on October 20. Security firm watchTowr confirmed that they are remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. PHP will publish technical details and the fixed versions with the release. PHP reserves the right to release earlier if details become public or attacks start.
What to do
You need to fix PHP2Shell at the infrastructure level, by updating PHP on your servers. You cannot fix it from within your store codebase.
If you do not manage your web server stack, ask your hosting provider today to stand by and apply the PHP update as soon as it is released.
PHP only supports version 8.2 and later. Servers on PHP 8.1 or older will not get an official fix. Ask your provider to backport the fix or move you to a supported PHP version.
Sansec Shield
If possible, we will release an application-level mitigation in Sansec Shield. From what we know so far, the attack targets PHP itself, before your store code and Shield run. Do not wait for a Shield rule to protect you.
Timeline
| Date (UTC) | Event |
|---|---|
| 2026-10-20 15:20 | A Hacker News post reports two upcoming PHP RCE disclosures |
| 2026-10-20 | PHP announces a critical security release; watchTowr confirms the leak |
| 2026-10-21 14:00 | Scheduled PHP security release |
We will update this article as we learn more.
Read more
- BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)
- StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
- PolyShell: unrestricted file upload in Magento and Adobe Commerce
- Critical backdoor found in MGT Varnish extension
- SessionReaper attacks have started, 3 in 5 stores still vulnerable
In this article
Protect your store now!
Block all known Magento attacks, while you schedule the latest critical patch until a convenient moment. No more downtime and instability from rushed patching.
Get Sansec ShieldScan your store now
for malware & vulnerabilities
eComscan is the most thorough security scanner for Magento, Adobe Commerce, Shopware, WooCommerce, Sylius and many more.
Learn more
