Critical Severity
CVE-2026-109619
Published: Oct 26, 2026
Crónica y PoC del patch-day de PHP (21-oct-2026): CVE-2026-109618 / CVE-2026-109619 — RCE pre-auth en mod_php. Primitiva reproducida en stock 8.5.11 y en Nextcloud real. Lab-only.
# CVE-2026-109618 / CVE-2026-109619 — PoC, analysis & the PHP patch-day chronicle (Oct 21, 2026)
🇪🇸 Versión en español: [LEEME.md](LEEME.md)
On October 21, 2026 (14:00 UTC), PHP shipped an out-of-band emergency release — **8.5.12 / 8.4.27 / 8.3.36 / 8.2.35** — fixing **two unauthenticated remote code execution** vulnerabilities in the core, confirmed by the PHP security team. This repo documents the **full patch-day chronicle** (leak → self-correction → independent audit → release) plus the **lab work done the same day**: what we reproduced, what we burned, what remains open.
**Credits & sources**: original leaked material by **@J4ck3LSyN** ([jackalsyn.com/posts/php-up-2026.html](https://jackalsyn.com/posts/php-up-2026.html), with corrections from Andrew Dorman (@acd421) and Arch&Yuki (@ArchKnight23)); audit by **xuehuolll** ([CVE-2026-109618-109619-audit](https://github.com/xuehuolll/CVE-2026-109618-109619-audit)); confirmation by **watchTowr**; official notice from **php.net** ([Oct-21 advisory](https://www.php.net/archive/2026.php#2026-10-21-5)). Plus the same-day post-release analysis by **daubois** ([What the PHP2Shell rumors got wrong](https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/) — written against the actual diff).
⚠️ **Disclaimer**: everything here is marked **lab-only**. The PoCs exist to reproduce the bug in **your own controlled, authorized environment** — never against systems you don't own. The patch went live on **Oct 21, 2026 (14:00 UTC)**: updating is the only complete defense; this repo is a forensic chronicle, not ammunition.
## The patch-day chronology
| When | What happened |
|---|---|
| Oct 20, 15:20 UTC | **The leak**: anonymous Hacker News post («2x PHP RCE CVEs with CVSS 10.0 Incoming»). The noise that followed: CVSS 10.0 (unofficial), "affects PHP 5 onward", and a screenshot of an exploit tool **PHP2Shell** credited to Calif.IO whose banner claims "works since PHP 5.4.0" |
| Oct 20, later | **watchTowr confirms**: 2 real