PHP Foundation patches two critical unauthenticated RCE bugs, PHP2Shell
Calif's proof-of-concept shows unauthenticated remote code execution; mass exploitation is described as avoided so far.
78
Vendor
PHP Foundation
- Mentions · 7d12
- Mentions · 30d12
- All mentions12
- First seenOct 20, 2026
- Last mentioned1d ago
Timeline
12 articles · newest firstVulnCheck exploit bypasses ASLR for PHP2Shell remote code execution
The private exploit chains a memory leak into RCE on PHP 8.4.26 with ASLR on and display_errors off.
82
PHP2Shell flaws drew millions of exploit attempts, some before disclosure
Amazon saw a honeypot hit on October 17, four days before patches, and Cloudflare has since logged millions of attempts.
86
PHP emergency patches fix two critical unauthenticated RCE flaws
Both CVSS 9.2 bugs affect web-facing PHP, including PHP-FPM and mod_php; fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
84
Critical PHP RCE flaws affect Cisco products, Cisco says
CVE-2026-109618 and CVE-2026-109619, dubbed PHP2shell, are fixed in a PHP Foundation release announced October 21.
72
NSA warns of two critical PHP flaws present since version 5
OpenAI and Wiz say the holes were found before attackers; unpatched sites should go offline, and PHP 8.5.12 is recommended.
82
PHP patches PHP2Shell RCE bugs as exploit attempts hit sensors
CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, are fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
92
Critical PHP flaws let unauthenticated attackers run code on web servers
CVE-2026-109618 and CVE-2026-109619 score 9.2; only PHP 8.2 and newer get official patches, and Cloudflare reported early attacks.
90
Cloudflare deploys default WAF rules against php2shell PHP flaws
Cloudflare says it saw mutated exploit traffic before disclosure; free and paid WAF plans are covered by default.
90
Cloudflare reports early attacks on two critical PHP flaws
Both flaws are scored CVSS 9.2; the PHP security release is set for October 21 at 14:00 UTC, with no CVE ids given.
78
PHP Foundation to patch two critical vulnerabilities in PHP
The October 20, 2026 notice names no CVE identifiers, affected versions, fixed releases, or known exploitation.
64
PHP flaws CVE-2026-109618 and CVE-2026-109619 may allow unauthenticated RCE
CERT-EU says details are unpublished, every PHP release since PHP 5 may be affected, and the fix is set for 21 October at 14:00 UTC.
76
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-10961812%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- PHPproduct · 12
- Wizorganization · 6
- OpenAIorganization · 6
- Cloudflareorganization · 5
- Califorganization · 3
- NCSCorganization · 2
- Hadrianorganization · 2
- GPT-5.6 Solai model · 2
- WordPressproduct · 2
- CERT-EUorganization · 2
- MediaWikiproduct · 1
- NCSC-NLorganization · 1
- NSAorganization · 1
- Gemini 4 Argonai model · 1
- Joomlaproduct · 1
- Ciscovendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.