CVE-2025-55182CampaignPublished 10/22/2026

Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)

Affects Meta React Server ComponentsSource AlienVault OTX General

Severity

Unrated

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 12/05/2025
KEV deadline: 12/12/2025
Ransomware: Used in ransomware campaigns
EPSS: 99.8% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involving out-of-memory corruption during multipart/form-data parsing via session.upload_progress, were leaked before their scheduled patch date. These vulnerabilities have a CVSS v4.0 score of 9.2 but no confirmed successful exploitation in the wild as of October 21, 2026. Scanning activity began shortly after the patch release, linked to a Mirai-style IoT botnet targeting platforms like WooCommerce, WHMCS, and Magento. Despite exposure of over 683,000 IPs running vulnerable PHP versions, technical challenges such as address-space randomization limited reliable exploitation. No official patch information is provided in the data. The threat is currently categorized as a campaign involving php2shell tooling staged across multiple attacker workspaces.

Summary

CVE-2026-109618 and CVE-2026-109619 are critical remote code execution vulnerabilities in PHP core caused by out-of-memory corruption during multipart/form-data parsing, exploitable without authentication via session.upload_progress. These flaws were leaked prior to their scheduled patch on October 21, 2026, with scanning and attack attempts detected within 20 minutes of patch release. The attacker infrastructure analysis revealed multiple workspaces preparing php2shell exploit tools targeting popular e-commerce and hosting platforms such as WooCommerce, WHMCS, and Magento. Although over 683,000 IPs with vulnerable PHP versions were exposed, no confirmed successful exploitation was observed, likely due to the complexity of bypassing address-space randomization protections. The campaign activity is linked to a Mirai-style IoT botnet. No patch or remediation details are provided in the input data.

Impact

If successfully exploited, these vulnerabilities allow unauthenticated remote code execution on affected PHP installations, potentially leading to full system compromise. The widespread exposure of vulnerable PHP versions across hundreds of thousands of IPs increases the attack surface. However, as of the provided date, no confirmed successful exploitation in the wild has been reported, and technical mitigations such as address-space randomization have limited reliable exploitation.

Defensive guidance

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches are available, monitoring for scanning activity and restricting access to vulnerable PHP services may reduce risk. Given the complexity of exploitation and lack of confirmed in-the-wild compromise, immediate emergency response is not indicated but vigilance is advised.