PHP2Shell: What it is and why you don’t need to panic
Last updated: Oct. 27, 2026 [09:00 AM, UTC]
PHP2Shell is the nickname for two security holes found in PHP. Their official names are CVE-2026-109618 and CVE-2026-109619 (CVE is the public catalog security researchers use to track vulnerabilities).
About 69% of websites with a known server-side language run on PHP, the language behind logins, contact forms, and checkout carts. The scripting language also powers popular content management systems (CMSs) such as WordPress, Magento, Drupal, and Joomla.
This helps explain why PHP2Shell became big news, as PHP runs under a wide range of websites and…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.