Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

PHP ships emergency fixes for critical PHP2Shell flaws amid early attacks

3 sources · 3 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP patched two critical runtime flaws, CVE-2026-109618 and CVE-2026-109619, while Cloudflare reported early exploit attempts.

PHP released emergency fixes on October 21, 2026, for two unauthenticated memory-safety flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Most outlets rate both CVSS 9.2; SANS Internet Storm Center cited an expected score of 9.4. Releases from PHP 5.4 onward are affected, including default installs; fixed builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and earlier are unsupported, though minimal source backports exist for 7.4, 8.0 and 8.1. Wiz says it demonstrated pre-authentication code execution against WordPress, Drupal and Joomla. Cloudflare reported early attacks and default WAF coverage; The Hacker News says watchTowr saw no exploitation as of 11:26 UTC, and Recorded Future says success is unconfirmed.

Key facts
  • Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
  • Both flaws are CVE-2026-109618 and CVE-2026-109619, mostly rated 9.2.
  • PHP says updating is the only complete fix; upload-progress changes are partial.
  • Cloudflare WAF rules went live October 21 at 03:02 UTC.
  • Host estimates range from about 1.3 million to over 5.1 million.
  • Outlets disagree on which CVE corresponds to which memory bug.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026PHP announced an out-of-band release for October 21. · Recorded Future
  2. Oct 21, 2026Cloudflare deployed WAF rules at 03:02 UTC. · Cloudflare Blog
  3. Oct 21, 2026PHP released emergency fixes for both flaws. · Wiz Blog

What each outlet adds

beyond the shared facts
  • Recorded FutureA researcher later withdrew the theory behind two alleged PoCs.
  • Cloudflare BlogWAF rules went live at 03:02 UTC, including free plans.
  • The Hacker NewswatchTowr saw no exploitation by 11:26 UTC; not in KEV.
  • BleepingComputerCites a VirusTotal estimate above 5.1 million PHP hosts.
  • Wiz BlogDemonstrated pre-auth code execution on WordPress, Drupal and Joomla.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPPHP FoundationPHP GroupCloudflareWiz
Products
PHPWordPressDrupalJoomlaLaravelMagentoPHP-FPMApacheFrankenPHPLiteSpeed
Victims
BambooHR
Organizations
CloudflareUK National Cyber Security CentreWizOpenAIwatchTowrCISACalif.ioQuarkslabPHP projectCERT-EUNational Cyber Security CentrePatchstack
Countries
United Kingdom

Coverage

oldest first · one row per article · UTC
  1. · 10d ago Recorded FutureFirst report

    Patchstack and Cloudflare report early PHP2Shell exploitation

    Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; reporting does not confirm how widely attacks succeeded.

  2. · 10d ago Datadog Security Labs

    PHP fixes two critical RCE flaws, CVE-2026-109618 and CVE-2026-109619

    Patched builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; PHP 5 through 8.1 stay vulnerable and unpatched.

  3. · 10d ago Elastic Security Labs

    PHP patches two leaked critical core RCE flaws after early disclosure

    Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; watchTowr reports no observed attacks.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV