PHP2Shell critical RCE bugs exploited as disclosure embargo collapsed
Original title: PHP2Shell exposes the weakness in coordinated vulnerability disclosure
Cloudflare’s CEO said attempts reached millions after the October 21 release, which came 24 hours early.
The PHP Foundation says Chainguard published fixed images before a coordinated embargo, prompting an early public patch for CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. The bugs can allow remote code execution. Calif briefly posted a proof-of-concept video after CVE IDs circulated on October 20. Cloudflare and AWS say exploit attempts began before the public release; some organizations took websites offline. Chainguard’s CEO said the company released early after seeing active exploitation.
Unconfirmed: AWS says it is unclear how an actor obtained exploit details before disclosure; Chainguard says exploits were already active.
- The embargo was set for October 22 at 14:00 UTC, then moved to October 21.
- Chainguard published fixed images on October 21 at 07:41 UTC, about six hours early.
- AWS reported an exploit attempt on October 17 from an anonymization-network address.
- A PHP contractor noted the out-of-memory issue as early as 2024.
- The bugs are rated 9.2; affected PHP versions are not stated.
Impact: Remote code execution through two critical PHP bugs
| Product | Affected |
|---|---|
| The PHP Foundation PHP | — |
- 1.Install the PHP project patches made public on October 21.
- 2.Assume exploit details spread before every distributor finished packaging fixes.
- Vendors
- The PHP Foundation
- Products
- PHP
- Organizations
- ChainguardCloudflareAWSCalif
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
From the original article
5 min read at csoonline.com
Two critical vulnerabilities discovered in the widely-used PHP programming language have shaken up enterprises, and the ramifications will take some time to truly understand. But one of the lesser-known stories centers around disclosure.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.