# PHP2Shell (CVE-2026-109618, CVE-2026-109619) · VamiSec × Wiz

> Briefing and exposure-check page by VamiSec GmbH (Bonn, Germany), a certified Wiz partner. It summarizes Wiz Research's PHP2Shell disclosure of October 21, 2026, gives verified versions, mitigations, detection hints and EU/German reporting duties, and offers a short-notice exposure check from the outside (Wiz ASM, Wiz Red Agent, recon and attack surface management with VamiRedteam) and from the inside (agentless Wiz cloud and Kubernetes connectors with minimal read permissions).

Status: 2026-10-23. Key facts, all from primary sources linked on the pages:
- Two critical memory-safety flaws in the PHP core, assigned by the PHP project: CVE-2026-109618 ("RCE via OOM corruption") and CVE-2026-109619 ("RCE via stale global state"), both CVSS v4.0 9.2.
- Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released October 21, 2026). PHP 8.1, 8.0 and 7.4 received minimal source backports only; older branches get no upstream fix. Distribution packages may contain the fix without a new version number.
- Affects all PHP installations serving web requests (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed); Wiz says every PHP version back to 5.4 is affected by at least one flaw.
- Workarounds and WAF rules are partial; updating PHP and restarting all PHP processes is the only complete remediation.
- As of the status date, exploitation attempts are widely reported, but no authority (BSI, CISA) has confirmed successful exploitation; the CVEs are not in CISA KEV.
- Detection: Assetnote published the open-source php2shell-scanner (https://github.com/assetnote/php2shell-scanner) on October 22, 2026. It detects the vulnerable behavior over HTTP without executing code, sends about 29 MiB per tested path, deliberately triggers memory errors and can report false positives on low memory_limit settings. Use it only with authorization; VamiSec supports planning and analysis, including recon and attack surface management with VamiRedteam (https://vamiredteam.com/).
- This page is published by VamiSec GmbH, not by Wiz. Wiz is a trademark of Wiz, Inc.

## Pages

- [PHP2Shell – Deutsch](https://php2shell.wiz.vamisec.com/): German page (primary)
- [PHP2Shell – English](https://php2shell.wiz.vamisec.com/en/): English page

## Primary sources

- [Wiz Research: PHP2Shell](https://www.wiz.io/blog/php2shell-php-rce): original research, October 21, 2026
- [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5): fixed releases and official workarounds
- [GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w): CVE-2026-109618
- [GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp): CVE-2026-109619
- [BSI IT-Sicherheitshinweis](https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.html): German Federal Office for Information Security

## VamiSec

- [VamiSec × Wiz](https://wiz.vamisec.com/): VamiSec's Wiz partner page
- [VamiRedteam](https://vamiredteam.com/): agentic platform for recon, attack surface management and pentesting
- [VamiSec](https://vamisec.com/): AI-driven IT security and GRC, Bonn

## Optional

- [php2shell.com](https://www.php2shell.com/): Wiz overview page
- [assetnote/php2shell-scanner](https://github.com/assetnote/php2shell-scanner): open-source detection scanner