Story · 23 sources · 30 articlesfirst Oct 21, 14:00 UTCupdated Oct 21, 23:02 UTC (19h ago)

'PHP2Shell' Bugs Signal Red Alert for Security Industry

criticalVulnerabilityexploited in the wildimportance 90CVE-2026-109618 CVE-2026-109619

Merged summary · from the lead article

Informa TechTarget Cybersecurity DiveInformationWeekChannel DiveTechTarget: Cybersecurity Explore our brandsAn Informa TechTarget Publication Dark Reading Resource LibraryBlack Hat NewsOmdia CybersecurityAdvertise [](https://www.darkreading.com/) Newsletter Sign-Up [](https://twitter.com/DarkReading)[](https://www.linkedin.com/company/dark-reading/)[](https://www.facebook.com/darkreadingcom/)[](ht…

Coverage timelineoldest first · each row is one article

Oct 21, 14:00 UTC · 1d ago
The Hacker News· 90
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
Oct 21, 14:07 UTC · 1d ago
BleepingComputer· 90
PHP ships emergency patches for critical PHP2Shell flaws
Oct 21, 14:17 UTC · 1d ago
The Record· 90
Hundreds of websites taken offline as concern grows over two PHP vulnerabilities
Oct 21, 14:26 UTC · 1d ago
WIRED · Security· 83
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

Vulnerabilities in this storyAll →

CVE-2026-1096199.26%
PHP has various global state that temporarily points into request memory
published 1d ago· php php PoC ×7+1 related

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-109619