CVE-2026-109618PHP2Shell — Upload-Progress Use-After-Free in PHP
A use-after-free in the upload-progress handler of the scripting language (PHP) lets an unauthenticated attacker read freed server memory, including passwords and keys, and can lead to RCE. Versions since 5.4 are affected, and attacks began before the patch.
Read the risk
THE VITAL STATS- CVSS score
- 9.8/ 10 CVSS v3.1
- EPSS probability
- 99.9% Likelihood of exploitation
- Attack complexity
- Low Conditions needed to exploit
- Vendor score
- 9.2 (CVSS 4.0), source as of 2026-11-04
- Known exploited
- Yes — CISA KEV
- CVE published
- 2026-10-21
- Added to KEV
- 2026-10-26
- CISA due date
- 2026-10-29
- Exploit published
- Yes
- Confidence
- medium
- Kill chain
- initial access
- MITRE ATT&CK
- T1190
- Severity
- critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Public exploitYes, from a curated source as of 2026-11-04; the NVD record carries no exploit tag. Public proofs of concept do not work against a default PHP installation.
Also known asPHP2Shell
AffectedPHP 5.4 and later serving web requests, PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed
Attacker needsNetwork access to a PHP web endpoint and specific conditions on the target; public exploits mostly need a local file inclusion bug in the application.
Fixed inPHP 8.5.12, PHP 8.4.27, PHP 8.3.36, PHP 8.2.35
Behind the card
5 REFERENCES- 01CVE recordNVD recordnvd.nist.gov
- 02CISACISA Known Exploited Vulnerabilities catalogcisa.gov
- 03Vendor advisorymicrosoft.commicrosoft.com
- 04Writeupsansec.iosansec.io
- 05Vendor advisorygithub.comgithub.com
Field-level provenanceTRACE THE SOURCES +
Which source supports each field, when it was retrieved, and who extracted it.
| Fields | Source | Retrieved | Extractor | Confidence |
|---|---|---|---|---|
| cvss, exploitation.attack_complexity, published_at, references | nvd.nist.gov | 2026-11-04 | scrty-crds-pipeline/0.1 | high |
| exploitation.known_exploited, exploitation.kev_added, exploitation.kev_due | cisa.gov | 2026-11-04 | scrty-crds-pipeline/0.1 | high |
| epss | api.first.org | 2026-11-04 | scrty-crds-pipeline/0.1 | high |
| title, subtitle, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites | nvd.nist.gov | 2026-11-04 | claude-code | high |
| exploitation.exploit_available, exploitation.exploit_override | sansec.io | 2026-11-04 | human | high |
| cvss_vendor | sansec.io | 2026-11-04 | human | high |
| aliases, affected | microsoft.com | 2026-11-04 | human | high |
| remediation | microsoft.com | 2026-11-04 | claude-code | high |
| aliases, affected | sansec.io | 2026-11-04 | human | high |
| remediation | sansec.io | 2026-11-04 | claude-code | high |
Printing history
THE RECORD- r1Initial base card
First printing. This card has not been reprinted since publication.