PHP itself has two separate critical vulnerabilities. Together they are referred to as "php2shell," and both allow unauthenticated remote code execution with a CVSS score of 9.2.
CVE-2026-109618 is a memory corruption flaw in out-of-memory (OOM) handling. When PHP exhausts memory while processing a request, the cleanup logic continues to treat partially initialized request data as valid, which an attacker can leverage for code execution.
CVE-2026-109619 is a use-after-free vulnerability. A request's internal state persists after its memory has been freed, and when the same worker handles a subsequent request, it may reuse that stale state, leading to code execution.
Affected versions include all releases before PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, as well as the unsupported PHP 8.1 and earlier branches. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Key status: Both vulnerabilities have been confirmed as actively exploited in the wild. CISA has added them to its Known Exploited Vulnerabilities (KEV) catalog, and public PoC code is circulating. For PHP 7.4, 8.0, and 8.1, which cannot be upgraded immediately, the PHP security team has provided minimal source backports, though this does not restore regular support.
This is a use-after-free vulnerability in the Linux kernel's IPv4 TCP connection-establishment path, with a CVSS score of 9.8. The flaw resides in the inet_opt / ireq_opt memory management logic: when a SYN packet carrying IPv4 options is retransmitted, a concurrent memory access race can occur, causing the kernel to access already-freed memory.
Successful exploitation can result in kernel memory corruption, information disclosure, denial of service, and — under specific conditions, such as the presence of an MPTCP listener — remote root code execution. Anthropic demonstrated a two-stage exploit chain against an MPTCP listener on October 27, 2026.
Affected kernel versions start from 4.4 and span multiple long-term support branches, including 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.2. Fixed versions include Linux 6.1.190, 6.12.113, 6.18.56, and 7.2.10. Amazon Linux 2023 has released fixed kernel 6.1.189-236.400.
Key status: This is not a zero-day. Although successful exploitation has been demonstrated in a lab environment and several PoC repositories have appeared publicly, as of late October 2026 there were no confirmed in-the-wild exploitation reports and no complete, publicly available exploit code. Note that some distributions (such as RHEL 8/9/10 and Ubuntu 22.04–26.10) had not yet released patches at the time of reporting.
These two vulnerabilities are fundamentally different in nature and should not be conflated. The two PHP flaws are the most urgent threat: they are actively exploited, have public PoCs, are listed in CISA's KEV catalog, and affect the vast majority of web application deployments. The Linux kernel vulnerability, while technically rated higher, has no in-the-wild exploitation evidence to date, making it relatively less urgent — though RHEL and Ubuntu users should closely monitor patch availability.
Chat 24/7, Social links
