PHP ships emergency fixes as PHP2Shell exploitation attempts spread
First merged summary.
PHP patched two critical unauthenticated RCE bugs on October 21 after early exploit attempts; success on real systems remains unconfirmed.
The PHP project released emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, after a leak forced disclosure a day early. Both are scored CVSS v4.0 9.2 and can allow unauthenticated remote code execution on PHP installations serving web requests, back to at least PHP 5.4 for one bug. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. AWS says honeypots saw attempts on October 17 and later called exploitation broad, while WatchTowr and Amazon say they have not confirmed successful compromise of real systems. Dark Reading says older branches have no upstream patch; Wordfence, SecurityWeek and Sucuri say emergency source backports exist for 7.4, 8.0 and 8.1.
- CVE-2026-109618 is out-of-memory corruption; CVE-2026-109619 is stale global state.
- Supported fixes: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- CMS or plugin updates do not update PHP itself.
- Chainguard published fixed images at 07:41 UTC on October 21, before coordinated release.
- Cloudflare enabled WAF rules at 3:02 am UTC after seeing exploit traffic.
Timeline
dated events in the reporting · oldest first- Aug 1, 2026Calif, OpenAI and Wiz reported the bugs after AI-assisted analysis. · SecurityWeek
- Oct 17, 2026AWS honeypots logged PHP2Shell exploitation attempts during the embargo. · WIRED
- Oct 20, 2026An advance notice rated both flaws 9.2. · Wordfence
- Oct 21, 2026PHP disclosed the bugs a day early and shipped fixes. · SecurityWeek
What each outlet adds
beyond the shared facts- The RegisterPHP blames Chainguard for publishing fixed images more than six hours early.
- WIREDAWS logged October 17 attempts and later called exploitation broad.
- SecurityWeekNames the two bug classes and says WatchTowr saw no successful compromise.
- WordfenceLab code execution for one bug failed on a normal optimized build.
- Krebs on SecurityCites Reuters on European government sites going offline after disclosure.
Coverage
oldest first · one row per article · UTC- · 9d ago
Cisco TalosFirst report
Talos tracks two unauthenticated PHP core RCEs called php2shell
Talos had not seen exploitation as of October 21 and says about half of PHP systems may never be patched.
- · 9d ago
oss-security
PHP 8.2–8.5 RCE via stale global state (CVE-2026-109619)
PHP rates the core flaw critical at CVSS v4.0 9.2; fixed builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- · 9d ago
Kaspersky Securelist
PHP patches two critical unauthenticated RCE flaws after exploit leak
A public PoC dubbed PHP2Shell targets PHP 5 through 8; backports exist for 7.4, 8.0, and 8.1, but attacks are not confirmed.
- · 9d ago
Rapid7 Blog
PHP patches two critical unauthenticated RCE flaws
Both score CVSS 9.2; researchers built RCE exploits, and a public exploit is expected soon.
- · 9d ago
Krebs on Security
Actively exploited PHP bugs allow full server takeover
Fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; Cloudflare says it already saw exploit traffic.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |