Part of the PHP2Shell incident suite — fix commands & checker live there.

CVE-2026-109619

Windows best-fit character mapping lets soft-hyphen (0xAD) bypass the fix for argument escaping in php-cgi, reintroducing argument injection on certain locales.

ExploitedCISA KEV2026-10-24Patch available

NVD score

8.1 High

Weakness

CWE-88

Argument Injection

EPSS probability

99.8th percentile

Vector string

CVSS v3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected CPEs

cpe:2.3:a:php:php:*:*:*:*:*:*:*:* (8.2.0 ≤ v < 8.2.20)
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*

Vendor advisories

GHSA-78vj-982h · GitHub / php-src
USN-8948-1 · Ubuntu