Story · 7 sources · 8 articlesfirst Oct 21, 23:13 UTCupdated Oct 22, 16:13 UTC (1h ago)

PHP2Shell puts dozens of UK government services out of service

criticalVulnerabilityexploited in the wildimportance 60CVE-2026-109618 CVE-2026-109619 CVE-2026-111497

Merged summary · from the lead article

security Ministers report 32 unavailable and four partly disrupted, but no confirmed compromise The PHP2Shell security fiasco has forced 32 UK government services offline and left another four partially unavailable as Whitehall scrambles to patch the critical vulnerabilities wreaking havoc across the web. The figures were disclosed in the House of Lords on Thursday, where tech minister Baroness…

Coverage timelineoldest first · each row is one article

Oct 21, 23:13 UTC · 18h ago
Hacker News · security· 42
There isn't an easy exploit for this PHP vulnerability
00:00 UTC · 18h ago
Exploit-DB· 47
[remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
07:42 UTC · 10h ago
Latent Space· 35
[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol;…

Vulnerabilities in this storyAll →

CVE-2026-1096199.26%
PHP has various global state that temporarily points into request memory
published 1d ago· php php PoC ×7+1 related
CVE-2026-111497

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-109619 +1 related CVE CVE-2026-109618	PHP has various global state that temporarily points into request memory PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). NVD description · AI analysis pending	9.2	6%	PoC ×7	php php	—	1d ago
CVE-2026-111497	A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote… A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. NVD description · AI analysis pending	9.2	—	PoC ×4	—	—	3h ago