Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

PHP ships emergency patches for critical PHP2Shell flaws

3 sources · 3 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP has released emergency fixes for two critical runtime flaws, while Cloudflare reports early exploit attempts.

The PHP project released emergency patches on October 21 for CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, both rated 9.2. Unauthenticated attackers can run code or read worker memory on servers running PHP 5.4 or later; risk is highest with Apache mod_php, where the bug can trigger before application code. Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are unsupported, with source backports for 7.4, 8.0 and 8.1. Cloudflare said exploit traffic appeared before disclosure and enabled WAF rules at 3:02 a.m. UTC; The Hacker News says watchTowr saw no in-the-wild exploitation at 11:26 UTC, while The Record says watchTowr later saw proof-of-concept attempts that had not succeeded.

Key facts
  • Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • Both CVEs are rated 9.2 and affect PHP 5.4 and later web installs.
  • Cloudflare enabled default WAF rules at 3:02 a.m. UTC on October 21.
  • Host estimates differ: CyberScoop cites about 1.3–1.9 million; BleepingComputer cites over 5.1 million.
  • Updating site code or plugins does not patch the PHP runtime.
  • Some government and company sites went offline as a precaution.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026PHP advance notice rated both flaws 9.2 · Wordfence
  2. Oct 21, 2026Cloudflare enabled WAF rules at 3:02 UTC · Cloudflare Blog
  3. Oct 21, 2026PHP shipped emergency fixes for supported branches · The Hacker News
  4. Oct 21, 2026watchTowr reported no exploitation at 11:26 UTC · The Hacker News

What each outlet adds

beyond the shared facts
  • Cloudflare BlogWAF timing, free and paid rules, and memory-handling mechanisms
  • The Hacker NewsFixed versions, 11:26 UTC watchTowr status, and precautionary outages
  • BleepingComputerVirusTotal estimate of more than 5.1 million visible PHP hosts
  • The RecordwatchTowr saw proof-of-concept attempts that had not succeeded
  • CyberScoopResearcher and Shodan host estimates and the moved release time
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPPHP GroupPHP FoundationCloudflare
Products
WordPressDrupalJoomlaMagentoPHPLaravelPHP-FPMApacheFrankenPHPLiteSpeedApache mod_php
Victims
NintendoBambooHR
Organizations
CloudflareWizOpenAISANS Internet Storm CenterCERT-EUMalwarebytesUK National Cyber Security CentreWordfencePHP FoundationCalifNCSCwatchTowr
Countries
United KingdomFinlandFranceNetherlandsGermanyJapanAustralia

Coverage

oldest first · one row per article · UTC
  1. · 21d ago Cyber Security NewsFirst report

    Cloudflare sees early exploits of two leaked critical PHP flaws

    CVE-2026-109618 and CVE-2026-109619 are rated critical RCE at CVSS 9.2, but PHP has not published affected versions.

  2. · 21d ago CISA Advisories

    CISA urges immediate patch of critical php2shell RCE flaws

    Unauthenticated remote code execution hits every PHP install serving web requests; fixed builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

  3. · 21d ago GBHackers

    Cloudflare reports early attacks on two critical PHP flaws

    Both flaws are scored CVSS 9.2; the PHP security release is set for October 21 at 14:00 UTC, with no CVE ids given.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV