Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcritical

PHP ships emergency fixes for two critical unauthenticated RCE bugs

3 sources · 3 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP patched CVE-2026-109618 and CVE-2026-109619 on October 21 as exploit attempts were reported and some sites went offline.

On October 21, 2026, PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, both scored CVSS 9.2. They can allow unauthenticated remote code execution as the web worker on PHP serving web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed, with the highest risk on mod_php. Fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; limited source backports exist for 7.4, 8.0, and 8.1. A leak moved disclosure from October 22. Cloudflare and several firms reported exploit attempts, while watchTowr says it has not seen successful compromise. Finnish and Dutch public sites were taken offline, and PHP says only an update is a complete fix.

Key facts
  • CVE-2026-109618 is out-of-memory corruption; CVE-2026-109619 is stale state between requests.
  • Fixed supported releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
  • Wiz and Krebs say at least one bug reaches releases back to PHP 5.4.
  • Updating WordPress, Drupal, or other CMS software does not update PHP.
  • Chainguard published fixed images at 07:41 UTC on October 21.
  • CERT-EU advised isolating exposed applications if patching is not immediate.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026Advance notice rates both PHP flaws CVSS 9.2. · Wordfence
  2. Oct 21, 2026PHP ships fixes after a leak moves disclosure up. · SecurityWeek
  3. Oct 21, 2026Cloudflare enables WAF rules at 03:02 UTC. · Krebs on Security
  4. Oct 21, 2026Chainguard publishes fixed images at 07:41 UTC. · The Register

What each outlet adds

beyond the shared facts
  • Rapid7 BlogLists temporary ini mitigations; remirepo lacked updates that day.
  • Krebs on SecurityCloudflare saw exploit traffic; Ubuntu shipped updated packages.
  • SecurityWeekHadrian ties attempts to session upload-progress; RCE confirmed on mod_php.
  • The RegisterPHP blames Chainguard; Lorenc says the early release was deliberate.
  • WordfenceLab RCE for one bug only under special configuration.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPPHP FoundationPHP Group
Products
PHPWordPressDrupalJoomlaMagentoPHP-FPMApache mod_phpFrankenPHPLiteSpeed
Malware
PHP2Shell
Victims
noyb
Organizations
CloudflareWizOpenAISANS Internet Storm CenterWatchTowrHadrianCERT-EUMalwarebytesSucuriPatchstackWordfencePHP Foundation
Countries
ChinaRussiaFinlandNetherlands
AI models
GPT-5.6 Sol

Coverage

oldest first · one row per article · UTC
  1. · 9d ago Horizon3.aiFirst report

    PHP patches critical unauthenticated RCE flaws called PHP2Shell

    PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 fix two web-worker RCE bugs; in-the-wild attacks are not established.

  2. · 9d ago The Register · Security

    PHP releases emergency fixes for two critical unauthenticated RCEs

    Exploits are public, and Finnish and Dutch sites went offline while watchTowr says attempts have not succeeded.

  3. · 9d ago oss-security

    PHP 8.2–8.5 RCE via out-of-memory corruption (CVE-2026-109618)

    An allocation failure during request setup can leave incomplete state reachable, rated CVSS v4.0 9.2.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV