Sale of a 1-day exploit for PHP2Shell ([CVE-2026-109618, CVE-2026-109619](https://dbu.gs/vulnerability/CVE-2026-109619))

For informational purposes only.

Vulnerability type: Pre-Auth RCE
Affected versions:
– 8.2 (before 8.2.35)
– 8.3 (before 8.3.36)
– 8.4 (before 8.4.27)
– 8.5 (before 8.5.12)

PHP2Shell is a chain of two related critical PHP memory corruption vulnerabilities that may allow unauthenticated arbitrary code execution. [CVE-2026-109618](https://dbu.gs/vulnerability/CVE-2026-109619) affects the handling of out-of-memory conditions during HTTP request processing, while [CVE-2026-109619](https://dbu.gs/vulnerability/CVE-2026-109619) involves retaining stale global state between requests.

According to the seller, the exploit also works on PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which contain fixes for the vulnerability chain.

Price: $3M

A seller is offering a 1-day pre-auth RCE exploit chain for PHP2Shell, affecting PHP 8.2–8.5 before fixed versions, and claims it also works on patched releases; price is $3M.

Sale of a 1-day exploit for PHP2Shell (CVE-2026-109618, CVE-2026-109619)