---
type: "post"
id: "php2shell-security-advisory-two-critical-rce-flaws-in-1be379"
slug: "php2shell-security-advisory-two-critical-rce-flaws-in-1be379"
title: "php2shell Security Advisory: two critical RCE flaws in the PHP engine affect PHP 5.4+."
description: "Vercel’s security bulletin says PHP publicly disclosed two critical vulnerabilities on October 21, 2026: CVE-2026-109618 and CVE-2026-109619, collectively called php2shell."
retrieval_nugget: "Vercel’s security bulletin says PHP publicly disclosed two critical vulnerabilities on October 21, 2026: CVE-2026-109618 and CVE-2026-109619, collectively called php2shell."
published_at: "2026-10-21"
updated_at: "2026-10-21"
record_date: "2026-10-21"
date_kind: "published_at"
topics: ["security"]
entities: ["Vercel","PHP","WordPress","Drupal","Laravel","Magento","OpenAI","Wiz"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "Vercel reports it deployed WAF protections before disclosure and says PHP 5.4+ installations and major PHP frameworks are affected; patching remains essential."
prior_refs: ["memory:592c9dc4-991d-8a8c-ae31-be347a0f42d2","memory:1f81f446-2440-8bf4-a877-a562cd996154","memory:35cbf782-9617-8f54-a6c4-2ddfc02b7f31"]
source_url: "https://vercel.com/kb/bulletin/php2shell-security-bulletin"
source_urls: ["https://vercel.com/kb/bulletin/php2shell-security-bulletin"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:php2shell-security-advisory-two-critical-rce-flaws-in-1be379"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/php2shell-security-advisory-two-critical-rce-flaws-in-1be379/","markdown":"https://newruntime.com/posts/php2shell-security-advisory-two-critical-rce-flaws-in-1be379.md","json":"https://newruntime.com/posts/php2shell-security-advisory-two-critical-rce-flaws-in-1be379.json"}
---

# php2shell Security Advisory: two critical RCE flaws in the PHP engine affect PHP 5.4+.

## Retrieval answer

Vercel’s security bulletin says PHP publicly disclosed two critical vulnerabilities on October 21, 2026: CVE-2026-109618 and CVE-2026-109619, collectively called php2shell.

Vercel’s security bulletin says PHP publicly disclosed two critical vulnerabilities on October 21, 2026: CVE-2026-109618 and CVE-2026-109619, collectively called php2shell. Specially crafted HTTP requests may allow remote code execution, exposure of data from other requests, or denial of service. Vercel says working public exploits are available and exploitation attempts have been reported across the industry.

The flaws affect PHP 5.4 and later in default configurations. The bulletin names WordPress, Drupal, Laravel, and Magento as affected when running on a vulnerable PHP runtime. Patched releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Vercel advises updating the runtime immediately; changing application code or plugins is not sufficient. PHP 8.1 and earlier no longer receive regular updates from the PHP project.

Vercel says it deployed WAF rules before disclosure. They apply automatically at no cost to projects on Vercel, including PHP functions deployed there and requests proxied or rewritten to external PHP backends. The rules block known exploit patterns but do not cover requests that bypass Vercel’s network or replace patching. The bulletin does not establish the number of compromised systems or quantify the scale of attacks.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)