PHP patches two unauthenticated RCE flaws in four current branches
Maintainers say updating is the only fix, with the highest risk on Apache mod_php.
78
Product
LiteSpeed
- Mentions · 7d5
- Mentions · 30d5
- All mentions5
- First seenOct 21, 2026
- Last mentioned3d ago
Timeline
5 articles · newest firstPHP patches two critical unauthenticated RCE flaws
Fixes ship in 8.5.12, 8.4.27, 8.3.36 and 8.2.35; config changes do not fully close exposure.
78
Critical PHP use-after-free bugs allow unauthenticated code execution
CVE-2026-109618 and CVE-2026-109619, called php2shell, have fixes for PHP 8.2 through 8.5; a PoC exists but no active attacks are confirmed.
78
PHP patches two critical unauthenticated RCE flaws
Both score CVSS 9.2; researchers built RCE exploits, and a public exploit is expected soon.
86
PHP patches unauthenticated RCE flaws dubbed PHP2Shell
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; a public exploit hits before application code runs.
88
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-10961812%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- PHP-FPMproduct · 5
- FrankenPHPproduct · 5
- PHPvendor · 4
- mod_phpproduct · 2
- Apache mod_phpproduct · 2
- Cloudflarevendor · 1
- PHPproduct · 1
- Rapid7organization · 1
- Apacheproduct · 1
- National Cyber Security Centreorganization · 1
- PHP Groupvendor · 1
- php-cgiproduct · 1
- Canadian Centre for Cyber Securityorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.