Week 43 – PHP2Shell: Critical vulnerabilities threatening millions of websites

19 – 24 Oct 2026

Two recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have received critical CVSS scores of 9.2. These flaws in PHP’s memory management and error handling can allow unauthenticated remote code execution (RCE), potentially affecting websites running popular platforms such as WordPress, Drupal and Joomla.

The vulnerabilities affect PHP itself, not just individual applications, making their potential impact particularly widespread.

Immediate patching is strongly recommended.

Read White Hat IT Security’s latest CVE of the Week article to understand how PHP2Shell works, which systems are at risk, and what organizations should do to protect themselves.

White Hat IT Security is a Europe-based Managed Security Services Provider (MSSP) and proud Microsoft Solution Partner. Its Microsoft-verified managed security solutions (MXDR) reflect their deep expertise and commitment to excellence in cybersecurity. The company was awarded the Partner of the Year Hungary Award by Microsoft in 2024 and 2025.

With the largest incident response capacity in the CEE region, they’re trusted by organizations to deliver fast, effective, and proactive protection. Their portfolio includes penetration testing, vulnerability assessments, managed Cyber Threat Intelligence, as well as Governance, Risk and Compliance (GRC) consulting and specialized security training.

They are committed to supporting professional initiatives that aim to raise cybersecurity awareness and maturity—both for individuals and organizations. They regularly contribute to the community through knowledge sharing, education, and outreach, helping to build a safer digital future for all.