PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive. Attackers attempted to exploit two critical PHP vulnerabilities four days before the flaws became public, according to Amazon Threat Intelligence. “Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in…
Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. Tracked as CVE-2026-109618 and CVE-2026-109619, the two critical vulnerabilities let attackers gain remote code execution (RCE) on vulnerable systems. The PHP security team patched them on October 21 after urging admins one day earlier…
cyber-crime Cloudflare reports millions of exploit attempts, while Amazon spotted attackers trying their luck four days before patches landed Attackers are hammering servers with millions of attempts to exploit the critical PHP2Shell vulnerabilities , with Amazon revealing that someone was already going after the flaws four days before they were publicly disclosed. Cloudflare says it has recorded…
Informa TechTarget Cybersecurity DiveInformationWeekChannel DiveTechTarget: Cybersecurity Explore our brandsAn Informa TechTarget Publication Dark Reading Resource LibraryBlack Hat NewsOmdia CybersecurityAdvertise [](https://www.darkreading.com/) Newsletter Sign-Up [](https://twitter.com/DarkReading)[](https://www.linkedin.com/company/dark-reading/)[](https://www.facebook.com/darkreadingcom/)[](ht…
The two PHP vulnerabilities causing worldwide alarm first drew serious attention in August after an outside review by AI companies, the PHP Foundation explained in a lengthy statement on Wednesday. The organization said the history of one bug, CVE-2026-109618, dates back to 2024, when PHP underwent its first external security audit in several years, but officials took no action. The issue caused…
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild. Image: Shutterstock.com, Sashkin. The flaws at…
Wednesday, October 21, 2026 11:10 Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial intelligence and associated technologies played a key…
A set of vulnerabilities in one of the most popular scripting languages underpinning many websites set off alarm bells in the cybersecurity community on Tuesday evening. The maintainers of PHP — used to build and run web applications and the vast majority of websites — released an urgent notice warning of two new bugs. The vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — carry severity…
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities ( CVE-2026-109618 and CVE-2026-109619 ) tracked collectively as PHP2Shell. The two PHP2Shell unauthenticated RCE flaws affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. "We consider the risk highest…
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell , sit in the PHP runtime, not in any application, so a site is exposed even when its own code…
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these…
Details on two critical-severity PHP vulnerabilities named PHP2Shell have been leaked online ahead of scheduled coordinated disclosure and official patches. On Tuesday, PHP warned that patches for the critical issues, both with a CVSS score of 9.2, are planned for Wednesday, 21 October 2026 at 14:00 UTC (10:00 am ET), urging defenders to prepare for immediate patching. “All PHP users are…
PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, 8.2 through 8.5, can receive the fix, and no exploitation has been reported so far.…
The Latest Update Insikt Group has published a TTP Instance for PHP2Shell covering public proof-of-concept (PoC) exploits, observed exploit activity, and recommended mitigations. As of 7 PM UTC on October 21, 2026: Patch status: PHP released fixed versions on October 21, 2026: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Exploitation status : While there are some reports of emerging exploitation…
PHP releases the fix on Wednesday October 21 at 14:00 UTC, or earlier if technical details become public or attacks start. Ask your hosting provider today to stand by. PHP will release a fix for two critical vulnerabilities on Wednesday October 21 at 14:00 UTC (16:00 CEST, 10:00 EDT). The PHP security team rated both CVSS v4.0 9.2. A screenshot of an exploit tool named PHP2Shell, credited to…
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services. In an advisory published Tuesday ,…
Tech vendors, cybersecurity companies and government agencies have published advisories, detections and mitigations for the PHP2Shell vulnerabilities, while many software makers are still checking whether their own products are exposed. The two critical bugs , CVE-2026-109618 and CVE-2026-109619, can let unauthenticated attackers execute code remotely. Wiz, OpenAI and Calif identified them in…
Threat actors started probing for servers affected by two critical remote code execution (RCE) vulnerabilities in PHP four days before the fixes, Amazon reports. Patches for the two flaws, known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, were released on October 21, after the PHP Foundation and industry partners scrambled for weeks to build, verify, and validate them. On…
Introduction On October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” were publicly disclosed. Both vulnerabilities carry a CVSS v4.0 score of 9.2 out of 10. The PHP security team has released emergency patches and strongly encouraged all PHP users to update immediately. These flaws reside in the…
PHP has rolled out patches for two critical-severity vulnerabilities named PHP2Shell that could provide attackers with unauthenticated remote code execution (RCE). The issues are tracked as CVE-2026-109618 (out-of-memory (OOM) corruption) and CVE-2026-109619 (stale global state) and have a CVSS score of 9.2. For both, RCE was confirmed on Apache with mod_php. “Both issues sit in parts of PHP that…