Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

PHP ships emergency patches for critical PHP2Shell flaws

23 sources · 30 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP patched two critical unauthenticated runtime flaws on October 21 as vendors reported early exploit attempts and some sites went offline.

PHP released emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, after a leak moved disclosure from October 22. Both score 9.2, affect PHP back to 5.4 on web servers, and can allow unauthenticated code execution or memory exposure, especially under Apache mod_php. Fixes are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, plus source backports for 7.4, 8.0, and 8.1; PHP says only a runtime update is complete. Cloudflare enabled WAF rules at 3:02 UTC after seeing exploit traffic, and some operators took sites offline. The Hacker News says WatchTowr saw no exploitation by 11:26 UTC, while The Record and SecurityWeek report attempts without confirmed compromise; The Register says PHP blames Chainguard for images published at 07:41 UTC.

Key facts
  • Official fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • Source backports cover PHP 7.4, 8.0, and 8.1; older lines lack project updates.
  • CVE-2026-109618 is out-of-memory corruption; CVE-2026-109619 is stale worker state.
  • Wiz, Calif, and OpenAI are credited; Cloudflare also names Quarkslab.
  • BleepingComputer cites VirusTotal’s estimate of over 5.1 million exposed PHP hosts.
  • UK NCSC and CERT-EU urged patching or isolating exposed applications.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Cloudflare enables WAF rules at 3:02 UTC · Cloudflare Blog
  2. Oct 21, 2026Chainguard publishes fixed images at 07:41 UTC · The Register
  3. Oct 21, 2026PHP discloses flaws a day early and ships patches · SecurityWeek
  4. Oct 21, 2026WatchTowr reports no exploitation as of 11:26 UTC · The Hacker News

What each outlet adds

beyond the shared facts
  • Cloudflare BlogWAF timing, free ruleset ID, and paid block-mode guidance
  • The Hacker NewsWatchTowr’s 11:26 UTC no-exploitation statement and BambooHR outage
  • BleepingComputerVirusTotal estimate of more than 5.1 million exposed hosts
  • SecurityWeekSession upload-progress attacks and no confirmed compromise
  • The RegisterChainguard’s early images and PHP’s blame for the leak
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPPHP FoundationPHP GroupCloudflare
Products
PHPWordPressDrupalJoomlaMagentoPHP-FPMApacheFrankenPHPLiteSpeed
Victims
NintendoBambooHR
Organizations
CloudflareWizOpenAISANS Internet Storm CenterWatchTowrHadrianCERT-EUMalwarebytesUK National Cyber Security CentreSucuriPatchstackCalif
Countries
United KingdomFinlandFranceNetherlandsGermanyJapanAustraliaChinaRussia

Coverage

oldest first · one row per article · UTC
  1. · 4d ago WordPress.org · SecurityFirst report

    PHP project issues critical security release; sites urged to update

    Two critical flaws affect any PHP application; no WordPress update is planned, and PHP before 8.2 is unsupported.

  2. · 4d ago Help Net Security

    PHP patches unauthenticated RCE flaws dubbed PHP2Shell

    Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; a public exploit hits before application code runs.

  3. · 4d ago Ubuntu Security Notices

    Ubuntu: PHP request-handling bugs allow remote code execution

    One bug mishandles out-of-memory cleanup; the other reuses internal request state across PHP workers.

  4. · 4d ago Cloudflare Blog

    Cloudflare deploys default WAF rules against php2shell PHP flaws

    Cloudflare says it saw mutated exploit traffic before disclosure; free and paid WAF plans are covered by default.

  5. · 4d ago The Hacker News

    PHP patches two critical PHP2Shell RCE flaws as exploit attempts appear

    CVE-2026-109618 and CVE-2026-109619 are unauthenticated runtime flaws rated 9.2, including on a simple PHP page.

  6. · 4d ago BleepingComputer

    PHP releases emergency patches for critical PHP2Shell RCE bugs

    Unauthenticated attackers can run code as the web worker, and Cloudflare says it already saw early exploitation attempts.

  7. · 4d ago The Record

    Sites go offline as two critical PHP bugs draw early attacks

    Fixes are out only for PHP 8.2 and newer; Cloudflare and watchTowr report emerging attacks dubbed PHP2Shell.

  8. · 4d ago WIRED · Security

    Critical PHP flaws let unauthenticated attackers run code on web servers

    CVE-2026-109618 and CVE-2026-109619 score 9.2; only PHP 8.2 and newer get official patches, and Cloudflare reported early attacks.

  9. · 4d ago Cyber Security News

    PHP ships emergency fixes for PHP2Shell RCE flaws

    Both flaws score CVSS 9.2; unauthenticated code execution was shown on Apache mod_php under default limits.

  10. · 4d ago Horizon3.ai

    PHP patches critical unauthenticated RCE flaws called PHP2Shell

    PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 fix two web-worker RCE bugs; in-the-wild attacks are not established.

  11. · 4d ago The Register · Security

    PHP releases emergency fixes for two critical unauthenticated RCEs

    Exploits are public, and Finnish and Dutch sites went offline while watchTowr says attempts have not succeeded.

  12. · 4d ago oss-security

    PHP 8.2–8.5 RCE via out-of-memory corruption (CVE-2026-109618)

    An allocation failure during request setup can leave incomplete state reachable, rated CVSS v4.0 9.2.

  13. · 4d ago Cisco Talos

    Talos tracks two unauthenticated PHP core RCEs called php2shell

    Talos had not seen exploitation as of October 21 and says about half of PHP systems may never be patched.

  14. · 4d ago oss-security

    PHP 8.2–8.5 RCE via stale global state (CVE-2026-109619)

    PHP rates the core flaw critical at CVSS v4.0 9.2; fixed builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

  15. · 4d ago Rapid7 Blog

    PHP patches two critical unauthenticated RCE flaws

    Both score CVSS 9.2; researchers built RCE exploits, and a public exploit is expected soon.

  16. · 4d ago Krebs on Security

    Actively exploited PHP bugs allow full server takeover

    Fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; Cloudflare says it already saw exploit traffic.

  17. · 4d ago Ubuntu Security Notices

    USN-8948-2 backports PHP code-execution fixes to older Ubuntu

    CVE-2026-109618 and CVE-2026-109619 can let a remote attacker run code while PHP handles requests.

  18. · 4d ago oss-security

    PHP 8.2–8.5 RCE via stale global state reported

    A mailing-list note says Fediverse reports of the fix are not yet fully confirmed.

  19. · 4d ago Hacker News · security

    PHP patches two critical remote code execution flaws

    Unauthenticated code execution was demonstrated on Apache with mod_php under default settings for the memory bug.

  20. · 4d ago oss-security

    oss-security reply questions PHP CVE-2026-109619 identity

    The post only relays a claim that the issue may be a different vulnerability, with no technical details.

  21. · 4d ago Malwarebytes Labs

    PHP2Shell flaws draw early attacks; emergency PHP updates out

    Fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; both bugs are rated 9.2.

  22. · 4d ago SecurityWeek

    PHP patches PHP2Shell RCE bugs as exploit attempts hit sensors

    CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, are fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

  23. · 4d ago The Record

    PHP says AI review revived critical bugs first flagged in 2024

    Cloudflare saw exploitation attempts Wednesday, while the foundation says Chainguard published the fix before coordinated disclosure.

  24. · 4d ago Canadian Centre for Cyber Security

    Critical PHP use-after-free bugs allow unauthenticated code execution

    CVE-2026-109618 and CVE-2026-109619, called php2shell, have fixes for PHP 8.2 through 8.5; a PoC exists but no active attacks are confirmed.

  25. · 4d ago oss-security

    PHP team reportedly rejects claimed PHP 8.2–8.5 RCE

    Canonical was told the Mastodon-reported issue is unrelated and not a real vulnerability.

  26. · 4d ago Simon Willison

    PHP 8.x security updates fix two remote code execution flaws

    Exploit notices circulated October 20 with a wrong CVSS of 10.0; the stated score is 9.2.

  27. · 3d ago Sucuri Blog

    PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 exploited in the wild

    Fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 7.4, 8.0 and 8.1 get emergency source backports only.

  28. · 3d ago CSO Online

    PHP emergency patches fix two critical unauthenticated RCE flaws

    Both CVSS 9.2 bugs affect web-facing PHP, including PHP-FPM and mod_php; fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

  29. · 3d ago Zscaler ThreatLabz

    PHP core flaws allow unauthenticated remote code execution

    CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, each score CVSS 9.2; emergency patches are out.

  30. · 3d ago The Register · Security

    PHP says Chainguard broke embargo on critical PHP2shell bugs

    CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution, and at least one hits every PHP release back to 5.4.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109619
+1 related CVE
CVE-2026-109618
Use-after-free RCE in PHP via stale request globals
9.2100%PoC ×13