Executive Summary

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) were disclosed affecting PHP, allowing attackers to execute arbitrary code remotely at the PHP runtime level, before application code runs. Due to the potential for full server compromise across approximately 75% of websites using a known server-side language, immediate patching is required as soon as the emergency release becomes available.

About CVE-2026-109618 and CVE-2026-109619

The issues, informally dubbed “PHP2Shell,” originate from flaws in the PHP core runtime, where the underlying vulnerabilities enable unauthenticated remote code execution. By sending specially crafted requests to any PHP-powered web server, attackers can gain full control of the underlying system, potentially pivoting to lateral movement, data exfiltration, and infrastructure-wide compromise. No authentication is required to exploit these issues.

Affected Systems

The following components are affected: PHP core runtime, versions potentially from 5.4 onward (unconfirmed), with only currently supported branches 8.2, 8.3, 8.4, and 8.5 scheduled to receive patches. These branches are used across virtually every major web framework and CMS platform, including WordPress, Laravel, Symfony, Drupal, and Magento, particularly when deployed on internet-facing servers. PHP versions 8.1, 8.0, 7.x, and 5.x are end-of-life and will not receive an official fix from the PHP project. An analysis found approximately 884,000 internet-facing hosts running PHP 8.1 or older, representing 59% of roughly 1.5 million hosts reporting a PHP version, plus an additional 740,000 hosts reporting PHP without a version number.

Users should upgrade to the patched PHP versions as soon as the emergency release drops (scheduled for October 21 at 14:00 UTC). Organizations running end-of-life PHP versions should upgrade to a supported branch (8.2 or later), or contact hosting providers about backported fixes. In the interim, CERT-EU has issued advisory 2026-018 recommending isolation of internet-facing PHP applications behind a VPN or WAF.

Risk Impact

At the time of writing, no public proof-of-concept exploit has been released, though security firm watchTowr has confirmed the flaws are real and reproduced CVE-2026-109618, and a screenshot of an exploit tool credited to Calif.IO has leaked. No confirmed in-the-wild exploitation has been reported yet. However, Sansec expects mass exploitation to begin within 15 minutes of patch release, as attackers can reverse-engineer the fix. The severity, ease of exploitation, and the sheer scale of the PHP attack surface make these vulnerabilities exceptionally high risk, especially for internet-facing deployments.

Successful exploitation could allow attackers to execute arbitrary commands on the server, access sensitive application data and databases, and potentially compromise the entire hosting infrastructure, leading to service disruption, data exposure, or full infrastructure compromise.

How Orca Can Help

Orca enables customers to quickly identify assets running vulnerable PHP versions, understand their exposure in context, including internet accessibility, runtime reachability, and asset criticality, and prioritize remediation based on real risk rather than CVSS alone. Orca’s platform highlights affected assets directly in the alert view, helping security teams focus on the most critical remediation paths first. Organizations can use Orca to inventory their entire PHP attack surface across cloud environments and prioritize patching of internet-facing workloads.