Get on Slack/Teams RSS
Last updated: November 2, 2026 at 1:20 PM UTC
All 957 Vulnerability 399 Breach 144 Threat 407 Defense 7
Tag: php2shell (2 articles)Clear
vulnerability
CVE-2026-109618CVE-2026-109619
2026-10-22

PHP ships emergency patches for two confirmed PHP2Shell code execution flaws as exploit attempts begin

PHP shipped emergency patches on October 21 for two runtime flaws collectively called PHP2Shell, now confirmed as CVE-2026-109618 and CVE-2026-109619 and rated 9.2, correcting the leaked 10.0 figure. They affect nearly every PHP version back to 5.4, with fixes in 8.5.12, 8.4.27, 8.3.36, and 8.2.35; branches 8.1 and older get no official update. Both live in the PHP runtime, so applications are exposed even with secure code, and the risk is highest under Apache mod_php. Cloudflare and watchTowr reported exploit attempts within hours, though no confirmed compromise. Wiz, Calif, and OpenAI's Codex Security team reported the flaws.

phpremote-code-executionphp2shellemergency-patchmod-phpexploited-in-wild
Check
Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 now, prioritizing Apache mod_php hosts, and migrate off end-of-life 8.1 and older.
Affected
Nearly every PHP version back to 5.4 carries two runtime flaws exposing applications to remote code execution and worker-memory reads regardless of the application's own code.
Fix
Install the PHP security releases, confirm distribution packages carry the CVE fixes, watch for exploit attempts now underway, and replace unsupported PHP branches.
vulnerability
2026-10-21

PHP schedules emergency release for two critical remote code execution flaws after early details leak

A leaked post disclosed two critical PHP remote code execution flaws, dubbed PHP2Shell, prompting PHP to schedule an out-of-cycle security release at 14:00 UTC on October 21 for supported branches 8.2 through 8.5. PHP rated both flaws 9.2 and has not described the mechanism, affected versions, or feature requirements, which will come with the release; the leaked identifiers CVE-2026-109618 and CVE-2026-109619 are not confirmed by PHP. watchTowr verified the leak is real and that the flaws allow code execution. No exploitation was reported as of October 21, and end-of-life branches 8.1 and older will receive no fix.

phpremote-code-executionemergency-patchweb-stackunpatchedphp2shell
Check
Prepare to apply PHP's out-of-cycle update for branches 8.2 through 8.5 as soon as it ships, and plan migration off end-of-life 8.1 and older.
Affected
Supported PHP branches 8.2 through 8.5 reportedly contain two critical remote code execution flaws, with end-of-life branches 8.1 and older receiving no fix at all.
Fix
Install the PHP security release immediately on all supported branches, upgrade off end-of-life versions, and watch for exploitation once the technical details become public.