Request a Demo

Threat Briefing · CVE-2026-109618 & CVE-2026-109619

Threat Briefing Webinar: PHP2Shell PHP Remote Code Execution Vulnerabilities

On-demand

UTC

15 minutes

UTC

15 minutes

On-demand

https://23785948.fs1.hubspotusercontent-na1.net/hubfs/23785948/watchTowr%20PHP2Shell%20Threat%20Briefing%20webinar.mp4

Jake Knott, Head of Threat Intelligence at watchTowr, covers what watchTowr has observed since it became the first to confirm the leaked vulnerabilities were real, and what our Attacker Eye honeypot network is seeing from exploitation attempts in the wild.

Jake Knott

watchTowr Intel
Head of Threat Intelligence, watchTowr

Vulnerability Summary

  • CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2): Two remote code execution vulnerabilities in PHP, known as PHP2Shell. They allow an unauthenticated attacker to run their own code on a PHP server and potentially take control of it.
  • Leaked before disclosure: Information about the vulnerabilities leaked on social media before PHP’s coordinated disclosure. watchTowr was the first to confirm the vulnerabilities were real.
  • Exploitation attempts in the wild: watchTowr’s Attacker Eye honeypot network has observed exploitation attempts since 21 Oct 2026. The vulnerabilities are not currently listed in the CISA KEV catalog.
  • Affects: PHP 5, 7 and 8. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4, 8.0 and 8.1 have limited updates, and PHP 5 has no patch.
What you will learn: in this threat briefing, Jake Knott, Head of Threat Intelligence at watchTowr, covers:
  • What watchTowr has observed so far, and how this situation has developed since watchTowr publicly confirmed that the leaked vulnerabilities were real.
  • What watchTowr Intel is seeing from exploitation attempts in the wild, based on our Attacker Eye honeypot network.
For the full background on CVE-2026-109618 and CVE-2026-109619, read the PHP2Shell FAQ, or request a demo of the watchTowr Platform for help rapidly validating your exposure to PHP2Shell.

Live briefing

Sign Up For the Webinar

Missed it?

Watch the recording or book a demo

This webinar has taken place. Book a demo and we will take you through the same material live.

Request a demo

Deployed in the world's most targeted industries

Technology

Banking

Government

Telecoms

Insurance

Healthcare

Crypto

Transport

Fintech

Manufacturing

Critical Infrastructure

Technology

Banking

Government

Telecoms

Insurance

Healthcare

Crypto

Transport

Fintech

Manufacturing

Critical Infrastructure

Attackers Don't Give Up. Neither Should Your Security Testing.

Zero install. No infrastructure changes. Uplift your security posture within hours of onboarding the watchTowr Platform.

Get Continuous Testing
Talk to our team
PHP2Shell Remote Code Execution FAQ

Frequently asked questions about PHP2Shell CVE-2026-109618 and CVE-2026-109619

Read The FAQ
Find Out What an Attacker Can Reach Before They Do.

Point us at a domain. We reconstruct your real external estate and come back with validated exposure, not a theoretical CVE list.

Request a Demo
See the Platform
Disclosure to Exploitation Is Four Hours. Patching Is Not.

The watchTowr Platform validates your exposure to an emerging threat and mitigates it at the edge while the vendor patch is still in testing.

Get Continuous Testing
How the Platform works
We Find the Vulnerabilities. You Hear It From Us First.

watchTowr Labs publishes what is being exploited right now and whether it touches your estate, not vendor summaries written a week late.

Read the Research
Talk to our team
Your Exposure Changes Weekly. Annual Testing Cannot Describe It.

Continuous, fully external validation of what an attacker can actually exploit against your estate, at a 0.01% false-positive rate.

Get Continuous Testing
Read the case studies
See the Estate You Own, Including What No Asset List Holds.

Subsidiaries, forgotten infrastructure, shadow IT. We rebuild your external surface from a single domain, then validate what is exposed.

Request a Demo
Explore use cases
4757