Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcritical

PHP ships emergency patches for two critical PHP2Shell flaws

3 sources · 3 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP has patched CVE-2026-109618 and CVE-2026-109619, both scored 9.2, as Cloudflare reports early exploit traffic.

On October 21, 2026, the PHP project released emergency fixes for two unauthenticated runtime flaws, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Both are rated CVSS 9.2 and can lead to remote code execution, denial of service, or data exposure on PHP installations that serve web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Official fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP 8.1 and older are unsupported, with limited source backports for 7.4, 8.0, and 8.1. Cloudflare says it saw exploit traffic and enabled WAF rules at 3:02 a.m. UTC, before disclosure. The Hacker News reports watchTowr had seen no in-the-wild exploitation as of 11:26 UTC, while The Record says watchTowr later reported proof-of-concept use whose attempts had not succeeded.

Key facts
  • Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • PHP says updating is the only complete fix; listed settings are incomplete.
  • Cloudflare WAF rules cover free and paid customers by default.
  • Exposure counts differ: about 1.3 million to 1.9 million hosts, or over 5.1 million.
  • Some government services, BambooHR, Nintendo, and the Port of Rotterdam went offline.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Cloudflare enables WAF rules at 3:02 a.m. UTC. · Cloudflare Blog
  2. Oct 21, 2026PHP releases emergency fixes after a planned October 22 disclosure. · The Hacker News
  3. Oct 21, 2026watchTowr reports no in-the-wild exploitation as of 11:26 UTC. · The Hacker News

What each outlet adds

beyond the shared facts
  • Cloudflare BlogNames Calif.io, Wiz, OpenAI, and Quarkslab; details default WAF coverage.
  • The Hacker NewswatchTowr saw no exploitation by 11:26 UTC; flaws were not in CISA KEV.
  • BleepingComputerCites a VirusTotal estimate of more than 5.1 million visible PHP hosts.
  • The RecordSays watchTowr saw proof-of-concept use, but attempts had not succeeded.
  • Rapid7 BlogLists temporary settings and says a public exploit is expected soon.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPPHP FoundationPHP GroupCloudflareWiz
Products
PHPWordPressDrupalJoomlaLaravelPHP-FPMApacheFrankenPHPLiteSpeedApache mod_phpMagento
Victims
NintendoBambooHRnoyb
Organizations
CloudflareWizOpenAISANS Internet Storm CenterUK National Cyber Security CentreCalifNCSCwatchTowrDetectifyCISACalif.ioQuarkslab
Countries
United KingdomFinlandFranceNetherlandsGermanyJapanAustralia

Coverage

oldest first · one row per article · UTC
  1. · 9d ago Security AffairsFirst report

    PHP schedules emergency fixes for two critical RCE flaws

    watchTowr reproduced CVE-2026-109618 privately, while PHP has not confirmed scope or published a workaround.

  2. · 9d ago Cyber Security News

    Public PoC tests critical PHP session flaws dubbed php2shell

    A repository claims PHP 5.4.0–8.5.11 are affected, but PHP has not yet confirmed versions or fixed builds.

  3. · 9d ago Infosecurity Magazine

    Critical PHP RCE flaws leaked a day before scheduled patches

    CERT-EU told operators to prepare to patch or isolate internet-facing PHP apps; the PHP team rates the flaws CVSS 9.2, not 10.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV