Theori Verifies PHP2Shell Flaw, Issues Emergency Patch Guide

Theori, an AI-based offensive cybersecurity company, announced on October 22, 2026 that it had reproduced and verified the PHP2Shell vulnerability in the PHP engine and published an emergency response guide for companies and organizations, according to digitaltoday.co.kr.

PHP2Shell is a flaw in the PHP engine itself that allows unauthenticated remote code execution or process memory reading. It is tracked as CVE-2026-109618 and CVE-2026-109619 and carries a CVSS v4.0 score of 9.2, rated Critical.

Affected versions are PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 and earlier, along with every end-of-life release below PHP 8.1, including the 7.x and 5.x lines. PHP recommends updating to the patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Temporary mitigations for update delays

For environments where an immediate engine update is difficult, Theori included emergency temporary mitigation measures in its guide. A senior researcher on Theori's AI & Cyber Research team said proof-of-concept code is spreading quickly and urged organizations to check their patch status per OS distribution without delay.

According to the background provided, a PoC demonstration video and patched binaries circulated before the official security advisory was published, and proof-of-concept code has been spreading rapidly.