Runtime vulnerability, severity critical
PHP core "PHP2Shell" RCE flaws (CVE-2026-109618, CVE-2026-109619) allow unauthenticated code execution
Published , updated
Two vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"), let an unauthenticated attacker execute code remotely on a server running a vulnerable PHP version. They are fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and no fixed release exists for PHP 8.1 or earlier. Google Cloud notes that for Apigee only customer-deployed Drupal-based developer portals are affected.
What's affected
- php runtime<8.2.0; >=8.2.0 <8.2.35; >=8.3.0 <8.3.36; >=8.4.0 <8.4.27; >=8.5.0 <8.5.12
What to do
- Upgrade PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 depending on your release line.
- PHP 8.1 and earlier have no fixed release, so move to a fixed supported release line.
- If you run a Drupal-based Apigee developer portal, follow the Apigee security bulletin instructions.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident php-php2shell-rce-2026-10References
Notice php-php2shell-rce-2026-10, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.