NCSC-NL/php2shell
Operational information regarding the 2026 php2shell vulnerabilities
Older snapshot: check the original source for current information.
From the publisher
README & documentation
Source previewRead the project’s overview, installation instructions and usage examples. The original README is the source of truth.
Operational information: 28 October 2026 13:48 CET Software list last status update: 28 October 2026 16:22 CET This repository contains operational information regarding the critical PHP vulnerabilities tracked by CERT-EU as CVE-2026-109618 and CVE-2026-109619. PHP is a widely used open-source server-side scripting language, so these vulnerabilities may affect a broad range of internet-facing web applications and products that embed or depend on PHP. This repository tracks 757 products, including 218 vulnerable and 144 fixed. On 21 October 2026, PHP published fixed releases for CVE-2026-109618 and CVE-2026-109619: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP states that both vulnerabilities can allow unauthenticated remote code execution and that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with modphp, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk highest for modphp, where an unauthenticated request can trigger exploitation before application code runs. PHP describes CVE-2026-109618 as remote code execution via out-of-memory…
Read the full README ↗ · Preview checked 2026-10-28T20:25:39.559Z
Inside the original README — Document outline
- php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619)
- TLP:CLEAR
- Current status
- Recommended actions
- Repository contents
- Software inventory statistics
- Latest software status updates
- Contributions welcome
Headings are captured from the source. Links open the publisher’s document, not a locally hosted copy.
Links from the README
References supplied by the publisher, not independently verified endorsements. Check the destination before downloading files or entering credentials.
Documentation belongs to its respective authors. Reported project/model license: EUPL-1.2. A listing is not a grant of reuse or training rights. Confirm the document’s own terms at the source.
What this repository does
Operational information regarding the 2026 php2shell vulnerabilities
Repository facts
- Owner
- NCSC-NL
- Primary language
- Python
- Stars
- 320
- Forks
- 108
- Open issues + pull requests
- 9
- License
- EUPL-1.2
- Archived
- No
- Default branch
- main
- Created
- 2026-10-21T10:21:40.000Z
- Last push
- 2026-10-28T12:10:44.000Z
Topics and intended use
No topics were included in the latest source metadata.
Review the README for scope, installation, examples and limitations. We do not run repository code or certify it.
Evaluate before installing
Review licensing and dependencies, inspect recent commits and unresolved issues, and test in an isolated environment before production use. Stars and forks alone cannot answer these questions.
Source and freshness
Source: GitHub. Metadata observed 2026-10-28T12:14:58.607Z. Daily imports are snapshots, not real-time monitoring.
Popularity and source listings do not establish security, suitability, licensing rights or benchmark performance.
Related repositories
EbookFoundation/free-programming-books
donnemartin/system-design-primer