Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

PHP ships emergency patches for critical PHP2Shell runtime flaws

5 sources · 5 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP patched two critical unauthenticated runtime flaws while sensors report exploit attempts but not confirmed compromise.

The PHP project released emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, after details leaked a day before a planned October 22 disclosure. Both are rated CVSS 9.2 and can let unauthenticated attackers cause denial of service, expose worker memory, or run code on web servers running PHP 5.4 or later. Official fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP 8.1 and older get source backports or vendor packages. Cloudflare deployed WAF rules at 3:02 a.m. UTC after seeing exploit traffic before disclosure. The Hacker News said watchTowr saw no in-the-wild exploitation as of 11:26 UTC; The Record and SecurityWeek later reported attempts, with WatchTowr saying none had succeeded.

Key facts
  • Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • Source backports were offered for PHP 7.4, 8.0, and 8.1.
  • Risk is highest on Apache mod_php, before application code runs.
  • CMS or plugin updates do not patch the PHP runtime.
  • Cloudflare WAF rules went live October 21 at 3:02 a.m. UTC.
  • Neither flaw was in CISA’s KEV catalog on October 21.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026Advance notice rated both PHP flaws 9.2. · Wordfence
  2. Oct 21, 2026Cloudflare enabled WAF rules at 3:02 a.m. UTC. · Cloudflare Blog
  3. Oct 21, 2026Emergency disclosure moved up from planned October 22. · The Hacker News
  4. Oct 21, 2026watchTowr reported no exploitation as of 11:26 UTC. · The Hacker News

What each outlet adds

beyond the shared facts
  • Cloudflare BlogWAF rules went live nine hours before disclosure.
  • SecurityWeekSeveral firms saw attempts, often via session upload-progress.
  • The Hacker NewswatchTowr saw no exploitation at 11:26 UTC; not in KEV.
  • BleepingComputerVirusTotal estimates over 5.1 million exposed PHP hosts.
  • WordfencePHP 8.2 reaches end of life on December 31, 2026.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPPHP FoundationPHP Group
Products
PHPWordPressDrupalJoomlaMagento
Malware
PHP2Shell
Victims
NintendoBambooHR
Organizations
CloudflareWizOpenAISANS Internet Storm CenterWatchTowrHadrianCERT-EUMalwarebytesUK National Cyber Security CentreSucuriPatchstackWordfence
Countries
United KingdomFinlandFranceNetherlandsGermanyJapanAustralia

Coverage

oldest first · one row per article · UTC
  1. · 9d ago Help Net SecurityFirst report

    PHP patches unauthenticated RCE flaws dubbed PHP2Shell

    Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; a public exploit hits before application code runs.

  2. · 9d ago Ubuntu Security Notices

    Ubuntu: PHP request-handling bugs allow remote code execution

    One bug mishandles out-of-memory cleanup; the other reuses internal request state across PHP workers.

  3. · 9d ago Cloudflare Blog

    Cloudflare deploys default WAF rules against php2shell PHP flaws

    Cloudflare says it saw mutated exploit traffic before disclosure; free and paid WAF plans are covered by default.

  4. · 9d ago The Hacker News

    PHP patches two critical PHP2Shell RCE flaws as exploit attempts appear

    CVE-2026-109618 and CVE-2026-109619 are unauthenticated runtime flaws rated 9.2, including on a simple PHP page.

  5. · 9d ago BleepingComputer

    PHP releases emergency patches for critical PHP2Shell RCE bugs

    Unauthenticated attackers can run code as the web worker, and Cloudflare says it already saw early exploitation attempts.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV