CVE-2026-109619: CVE-2026-109619 (PHP2Shell (CVE-2026-109618))

Executive Summary & Technical Impact

How security researchers at Calif used OpenAI's GPT-5.6 Sol under the Patch the Planet initiative to uncover the most critical PHP remote code execution flaw of the year.

Tracked under CVE-2026-109619 (CWE-Other (Security Advisory)), this vulnerability affects PHP < 8.5.12, < 8.4.27, < 8.3.36, < 8.2.35 and carries a severity score of 9.2 (CRITICAL). Engineering and security operations teams running PHP Infrastructure should prioritize upgrading to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35.

Remediation & Patch Guidance

1. Two critical Pre-Auth RCE vulnerabilities dubbed 'PHP2Shell' (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) affect all supported PHP branches, impacting an estimated 70% of websites running PHP.
2. The flaws were discovered by security firm Calif using the autonomous GPT-5.6 Sol model under OpenAI's 'Patch the Planet' initiative, and independently identified by researchers at Wiz.
3. CISA alongside national cyber agencies in Japan and Europe issued emergency advisories after AWS threat sensors detected active exploitation attempts in the wild.
4. Infrastructure teams must immediately upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

Frequently Asked Questions (CVE-2026-109619)

What versions are affected by CVE-2026-109619?

CVE-2026-109619 affects PHP < 8.5.12, < 8.4.27, < 8.3.36, < 8.2.35 in PHP Infrastructure (CVE-2026-109619 (PHP2Shell (CVE-2026-109618))).

How do I patch or remediate CVE-2026-109619?

Upgrade affected deployments to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-109619?

CVE-2026-109619 is rated CRITICAL with a CVSS score of 9.2 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).