# PHP2Shell

**What is PHP2Shell?**

PHP2Shell is the name for two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). They let an attacker run code on a web server without logging in. Since October 2026 they are being exploited in the wild.

Because the flaws are in PHP itself, almost every PHP application is affected as long as the PHP version is outdated. Fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later.

## Related terms
- [Exploit](https://vetosec.at/en/it-security/exploit/)
- [Zero-day vulnerability](https://vetosec.at/en/it-security/zero-day/)
- [Patch management and updates](https://vetosec.at/en/it-security/patch-management/)
- [CVE and CVSS](https://vetosec.at/en/it-security/cve-cvss/)
- [HTTP2Shell](https://vetosec.at/en/it-security/http2shell/)

## Source
https://vetosec.at/en/it-security/php2shell/ (vetosec, angriffe)