PHP releases emergency patches for two critical PHP2Shell flaws
First merged summary.
PHP has released emergency patches for two critical unauthenticated runtime flaws, while early exploit attempts and precautionary outages continue.
PHP released emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, after a leak moved disclosure up from October 22. The flaws, both scored 9.2, affect web-facing PHP back to 5.4 and can allow unauthenticated code execution, denial of service, or memory exposure. Official fixes are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP 8.1 and older get no project updates, with source backports for 7.4, 8.0, and 8.1. Cloudflare reported early attack traffic and enabled WAF rules at 3:02 a.m. UTC, while The Hacker News says watchTowr saw no exploitation as of 11:26 UTC and The Record and SecurityWeek say attempts have not confirmed compromise. CyberScoop cites more than 1.3 million exposed hosts and a Shodan count near 1.9 million; BleepingComputer cites VirusTotal’s estimate of over 5.1 million.
- Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- CVE-2026-109618 is out-of-memory corruption; CVE-2026-109619 is stale-state use-after-free.
- Highest risk is Apache mod_php, where a request can hit the bug before application code.
- Site or plugin updates do not fix the PHP runtime; only a PHP update does.
- Researchers credited include Wiz, Calif, OpenAI, and Quarkslab.
- BambooHR, Nintendo, and some government sites went offline as a precaution.
Timeline
dated events in the reporting · oldest first- Oct 20, 2026Advance notice rated both flaws CVSS 9.2 · Wordfence
- Oct 21, 2026Cloudflare enabled WAF rules at 3:02 UTC · Cloudflare Blog
- Oct 21, 2026Emergency PHP releases shipped a day early · SecurityWeek
- Oct 21, 2026watchTowr reported no in-the-wild exploitation at 11:26 UTC · The Hacker News
What each outlet adds
beyond the shared facts- Cloudflare BlogWAF rules went live at 3:02 UTC, including free plans.
- SecurityWeekBugs were reported in August; Hadrian cites session upload-progress attacks.
- WordfencePHP 8.2 support ends December 31, 2026; remirepo is signing packages.
- Krebs on SecurityUbuntu has shipped updated PHP packages.
- The RecordEU, Germany, Japan, Australia, the UK, and the Netherlands warned operators.
Coverage
oldest first · one row per article · UTC- · 9d ago
Wiz BlogFirst report
Wiz details PHP2Shell RCEs in core PHP back to 5.4
Unauthenticated attackers can run code or read worker memory that may hold passwords, tokens and keys; PHP patched on October 21, 2026.
- · 9d ago
CyberScoop
PHP rushes emergency patches as early php2shell attacks reported
Cloudflare says early attacks are emerging and has pushed temporary firewall rules to all customers, including free accounts.
- · 9d ago
Palo Alto Unit 42
Unit 42 warns of two critical PHP RCE flaws scored 9.2
Unit 42 says it has seen proof-of-concept code and telemetry showing over 22.6 million potentially exposed instances.
- · 9d ago
WordPress.org · Security
PHP project issues critical security release; sites urged to update
Two critical flaws affect any PHP application; no WordPress update is planned, and PHP before 8.2 is unsupported.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |