CVSS
PHP2Shell CVSS: 9.2, not 10.0
Both PHP2Shell CVEs are officially CVSS 4.0 9.2 — Critical. The 10.0 you may have seen came from the leak the day before the release.
Last reviewed 2026-10-22
| Score | Where it came from | Status |
|---|---|---|
| 9.2 | PHP security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp (CVSS 4.0), repeated by the PHP Foundation, watchTowr and most vendors. | Official |
| 10.0 | CVE IDs circulating on forums and social media from ~15:00 UTC on 20 Oct, before the advisories were public. Copied into early news articles. | Incorrect |
The vector, metric by metric
Both CVEs: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
| Metric | Meaning here | Effect |
|---|---|---|
AV:N Attack Vector: Network | Reachable over the internet with ordinary HTTP requests. | Raises score |
AC:H Attack Complexity: High | The exploit must be tuned to each target’s memory layout; it is not a one-request copy-paste. | Lowers score |
AT:P Attack Requirements: Present | Success depends on deployment conditions (SAPI, limits, worker reuse) the attacker does not control. | Lowers score |
PR:N Privileges Required: None | No account, no login. | Raises score |
UI:N User Interaction: None | Nobody has to click anything. | Raises score |
VC:H / VI:H / VA:H Vulnerable system impact: High | Full confidentiality, integrity and availability loss on the PHP server. | Raises score |
SC:N / SI:N / SA:N Subsequent system impact: None | The score does not count pivoting to other systems — in practice stolen credentials often allow it. | Lowers score |
Why it is not a 10
Two metrics pull the score down: AC:H (the exploit has to be adapted to each target’s memory layout through repeated attempts) and AT:P (success depends on how PHP is deployed — SAPI, memory limits, worker reuse).
Everything an attacker cares about most is at the worst setting: network-reachable, no privileges, no user interaction, full impact on the server.
What it means in practice
“Harder to exploit” is a speed bump for skilled attackers, and the embargo leaked a day early. Treat it like a 10: patch first, argue about the score later.
Questions
What is the official CVSS score of PHP2Shell?+
9.2 (Critical) under CVSS 4.0, for both CVE-2026-109618 and CVE-2026-109619, as published in the PHP security advisories.
Why did some sites report CVSS 10.0?+
The CVE IDs leaked on 20 October 2026, about a day before the coordinated release, together with an incorrect 10.0 score. Articles written from the leak repeated it. The PHP Foundation later confirmed that 10.0 was wrong.
Does 9.2 instead of 10.0 mean it is less urgent?+
No. The difference comes from the exploit needing to be adapted to each target (high complexity, attack requirements present). It is still unauthenticated, network-reachable remote code execution, with early attacks reported. Patch at the highest priority.
Related
- CVE-2026-109618CVE-2026-109618 (PHP2Shell): out-of-memory corruption, CVSS 9.2, affected and fixed PHP versions, SAPI exposure and temporary mitigations.
- CVE-2026-109619CVE-2026-109619 (PHP2Shell) in detail: stale per-request globals and use-after-free, memory disclosure, FPM exposure, CVSS 9.2, fixed versions and mitigations.
- Fix / patchFix PHP2Shell on Linux, Docker, cPanel, Plesk, macOS and Windows. Follow patch, restart and verification steps, including options for older PHP.