The PHP2Shell vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, pose a critical threat to approximately 70% of websites worldwide. These vulnerabilities allow unauthenticated remote code execution.
CVE-2026-109618 is an out-of-memory handling vulnerability that permits remote code execution. Meanwhile, CVE-2026-109619 is a use-after-free vulnerability that allows PHP to access stale references to freed memory, also potentially leading to remote code execution.
Both vulnerabilities were leaked before patches were available on October 21, 2026. The Cybersecurity and Infrastructure Security Agency (CISA) added these CVEs to its Known Exploited Vulnerabilities catalog on October 26, 2026, confirming their active exploitation.
A data breach at Denmark’s Central Population Register exposed the personal information of 8.8 million people.