Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed
Original title: Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw
CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.
The PHP team shipped emergency updates for PHP2Shell, two critical bugs rated 9.2 under CVSS v4.0 that allow unauthenticated remote code execution. Fixes landed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Palo Alto Networks says every PAN-OS and Panorama version is affected and has not released patched builds. The roundup also reports ConnectWise Cloud Backup credential abuse, a brief AOMEI Backupper supply-chain backdoor, and a sharp rise in malicious calendar invites.
Unconfirmed: The headline mentions an exploited GlobalProtect VPN flaw that this excerpt does not describe, and it does not say the PHP2Shell bugs are being exploited.
- OpenAI says Calif found one PHP flaw with GPT-5.6 Sol, and Wiz reported both.
- Searchlight Cyber released the open-source php2shell-scanner for both CVEs.
- ConnectWise says a Cloud Backup credential was used to enter customer Microsoft 365 accounts.
- Attackers changed AOMEI Backupper server configs for five to ten minutes, then restored them.
- Sublime recorded a 1,216% month-over-month rise in malicious calendar invites in August 2026.
Impact: Unauthenticated remote code execution on affected web servers
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| Palo Alto Networks PAN-OS | all versions | — |
| Palo Alto Networks Panorama | all versions | — |
- 1.Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- 2.Treat all PAN-OS and Panorama versions as exposed until Palo Alto ships fixes.
- 3.Review ConnectWise Cloud Backup application access to Microsoft 365.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1195.002 Compromise Software Supply ChainT1566 Phishing
- AI models
- GPT-5.6 Sol
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
From the original article
13 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: A critical PHP security release is coming today, so get ready to update! The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. The release fixes two vulnerabilities, each rated 9.
helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.