AI-based offensive cybersecurity company Theori said on Oct. 22 it has completed reproducing and verifying the recently disclosed critical PHP engine vulnerabilities PHP2Shell (CVE-2026-109618, CVE-2026-109619) and released an emergency response guide for companies and institutions.

PHP2Shell is a vulnerability caused by a flaw in the PHP engine itself, regardless of web application implementation code. An attacker can run arbitrary code remotely on a server without separate authentication to take control of the server or read process memory.

The company said the impact is very large, with a score of 9.2 (Critical) under CVSS v4.0.

PoC demonstration videos and a patched binary were leaked before an official security advisory was released, leading to rapid spread of PoCs based on them, it said, adding that companies need to respond quickly.

Theori's research team said that during the process of reproducing and verifying the attack code, it assessed it would only be a matter of time before other attackers also create and distribute exploits in the same way.

Affected versions are PHP 8.2.34, 8.3.35, 8.4.26 and 8.5.11 and earlier, as well as all versions of PHP 8.1 and earlier, which are out of support, including 7.x and 5.x. PHP has recommended an immediate update to the latest security patch versions, including 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Theori said the latest security patch is the best solution, but it also presented emergency temporary mitigation measures for environments where an immediate PHP engine update is difficult. It stressed that the temporary measures can cause side effects such as session function errors and cannot provide full defense, making rapid application of the latest patch essential.

Jun-oh Lim (임준오), a principal researcher at Theori's AI & Cyber Research team, said, "PHP2Shell is a highest-risk vulnerability that can put the entire server at risk regardless of application code." He added, "As PoCs are spreading quickly, you should immediately check whether patches are available for each OS distribution and upgrade to the latest version, and until you patch you should apply the temporary mitigations and inspection scripts released by Theori to immediately check configuration status and whether systems have been compromised."