Story · 26 sources · 30 articlesfirst Oct 20, 00:00 UTCupdated Oct 21, 13:56 UTC (1d ago)

Critical Vulnerabilities in PHP Require Immediate Patching

criticalVulnerabilityexploited in the wildimportance 90CVE-2026-109618 CVE-2026-109619 CVE-2024-4577 CVE-2026-103849 CVE-2026-75650 CVE-2019-11043 CVE-2012-1823

Merged summary · from the lead article

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these…

Coverage timelineoldest first · each row is one article

Oct 20, 00:00 UTC · 2d ago
CERT-EU Advisories· 66
2026-018: Critical Vulnerabilities in PHP
Oct 20, 20:56 UTC · 1d ago
BleepingComputer· 90
PHP warns admins of two critical flaws, emergency patches coming tomorrow
Oct 20, 22:48 UTC · 1d ago
Sansec (Magento / e-commerce security)· 90
Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619
Oct 21, 00:00 UTC

Vulnerabilities in this storyAll →

CVE-2012-1823—100%
PHP-CGI Query String Parsing Flaw Enables Unauthenticated Remote Code Execution
published —· PHP KEV
CVE-2019-110439.8100%
Buffer Overflow in PHP-FPM Enables Unauthenticated RCE on nginx Stacks

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2012-1823	PHP-CGI Query String Parsing Flaw Enables Unauthenticated Remote Code Execution PHP, when the interpreter is exposed through the CGI (php-cgi) interface, mishandles query strings (CWE-20 improper input validation), allowing attackers to pass command-line switches such as -d and -s directly to the interpreter. A remote, unauthenticated attacker triggers the flaw by sending a crafted query string beginning with a dash (including URL-encoded forms) to any URL handled by php-cgi. Successful exploitation allows arbitrary code execution under the web server's privileges, as well as disclosure of script source code or phpinfo output, with no authentication required. Only deployments that invoke PHP via CGI/FastCGI (common in legacy shared hosting and bundled software stacks) are affected; PHP running as an Apache module or via PHP-FPM is not exposed. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25 with EPSS at 100%, indicating active in-the-wild exploitation; any ransomware association is not yet confirmed. Do: Upgrade PHP to at least 5.3.13/5.4.3 or, preferably, a currently supported PHP branch, and stop exposing the php-cgi binary directly by moving to mod_php or PHP-FPM. As an interim mitigation, block or rewrite requests whose query string begins with a dash (e.g., -d, -s, or URL-encoded dash characters) and review web server logs for such patterns to detect prior exploitation.	—	100%	KEV	PHP Deployments running PHP through the CGI (php-cgi) interface at the time of disclosure; per public advisories this includes versions prior to 5.3.12/5.4.2, fixed	masshundreds of thousands of internet-exposed php-cgi endpoints (a subset of the tens of millions of PHP-powered websites)	— KEV Mar 25, 2022
CVE-2019-11043	Buffer Overflow in PHP-FPM Enables Unauthenticated RCE on nginx Stacks CVE-2019-11043 is a buffer overflow (CWE-120/CWE-787) in PHP's FastCGI Process Manager (PHP-FPM) affecting PHP 7.1.x before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11. In certain FPM configurations — commonly web servers such as nginx that split PATH_INFO via fastcgi_split_path_info without validating that the requested PHP script exists — an unauthenticated remote attacker can send a crafted request that makes PHP-FPM write past allocated buffers into the space reserved for FCGI protocol data. This corruption of the FastCGI protocol state allows the attacker to execute arbitrary code with the privileges of the PHP-FPM worker on the hosting web server. Anyone running a vulnerable PHP-FPM behind an affected configuration is exposed, including Linux distribution packages (Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, Red Hat Software Collections), Tenable.sc deployments, and QNAP NAS devices running vulnerable PHP. The flaw is being actively exploited in the wild — it is in CISA's KEV with known ransomware use (including campaigns such as NextCry targeting Nextcloud instances on Linux servers) — and a public proof-of-concept exploit exists, consistent with its 99.8% EPSS score. Do: Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later (or apply your distribution's/vendor's patched packages — CISA's KEV required action is to apply updates per vendor instructions; QNAP users should apply QNAP's released updates). As an interim mitigation, harden the nginx fastcgi_split_path_info configuration (prefix the regex with '^' and use try_files to confirm the script exists) or disable PATH_INFO where it is not needed. Prioritize internet-facing web servers, shared hosting, and QNAP/Nextcloud instances for patching and check them for compromise, given active ransomware exploitation.	9.8	100%	KEV
CVE-2024-4577	OS Command Injection in Windows PHP-CGI Allows Remote Code Execution CVE-2024-4577 is an OS command injection flaw (CWE-78) in Windows-based PHP when it runs in CGI mode, allowing arbitrary code execution on the server. It is triggered when attacker-supplied characters in HTTP requests are mishandled by Windows' character-encoding conversion as the OS invokes php-cgi, letting attackers inject command-line arguments to the PHP interpreter; this bypasses the decade-old fix for CVE-2012-1823. A successful attacker gains the ability to run arbitrary commands and code in the context of the web server. Affected systems are PHP running on Windows through the CGI interface; deployments that do not use PHP-CGI on Windows are not described as affected in the source data. Exploitation is active: the flaw was added to CISA KEV on 2024-06-12 with known ransomware use, and EPSS assigns roughly 100% probability of exploitation within 30 days. Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use: upgrade Windows PHP-CGI deployments to a PHP release that fixes CVE-2024-4577 per PHP Group advisories, or stop using CGI mode on Windows (e.g., switch to FastCGI) and apply any vendor-recommended workarounds. Given known ransomware abuse, review web server access logs for exploitation attempts (notably %AD-encoded soft hyphens and injected -d/-s arguments in php-cgi query strings) and prioritize patching internet-facing Windows hosts.	9.8	100%	KEV ransomware PoC ×11
CVE-2026-103849	Unauthenticated template-injection RCE in Adobe Commerce Adobe Commerce is affected by improper neutralization of special elements in a template engine (CWE-1336), a server-side template injection flaw. An unauthenticated remote attacker can trigger it over the network with no user interaction and low attack complexity. Successful exploitation can run arbitrary code in the context of the current user and, because scope is changed, can yield elevated access or control of a victim account or session, with high impact to confidentiality, integrity, and availability (CVSS 10.0). Storefronts running affected Adobe Commerce builds are at risk; the advisory data does not name version ranges. It is not listed in CISA KEV and no public proof-of-concept is known. Do: Apply the Adobe security update for this CVE as soon as a fixed release is published, and confirm the installed Adobe Commerce build against Adobe’s bulletin rather than assuming a version range. Until patched, restrict unauthenticated access to storefront and admin template features where possible, review template and email-template configuration for unexpected changes, and monitor for anomalous process execution or session hijacking.	10.0	<1%	PoC	Adobe Commerce	large
CVE-2026-109619 +1 related CVE CVE-2026-109618	PHP has various global state that temporarily points into request memory PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). NVD description · AI analysis pending	9.2	6%	PoC ×7	php php	—	1d ago
CVE-2026-75650	Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) Adobe Commerce and Magento (including Adobe Commerce B2B) contain an improper neutralization of special elements used in a template engine (CWE-1336), a template-injection flaw that permits arbitrary code execution in the context of the current user. The flaw is reachable over the network by unauthenticated attackers, requires no user interaction, and its changed scope (CVSS 3.1 S:C) means injected code executes beyond the vulnerable component, producing a maximum-severity (CVSS 10.0) remote code execution condition. A successful attacker gains arbitrary code execution on the storefront server; in the observed campaign, intruders installed a Rust backdoor and a PHP web shell (dubbed 'StyleSmuggler') on compromised servers. Any organization running an Adobe Commerce, Adobe Commerce B2B, or Magento storefront is in scope, with internet-facing e-commerce deployments most exposed. Exploitation is confirmed in the wild: the bug was abused as a zero-day before patching and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08. Do: Apply Adobe's released patches immediately per vendor instructions, prioritizing internet-facing Commerce/Magento storefronts, and ensure compliance with CISA BOD 26-04 timelines for KEV entries. Hunt for 'StyleSmuggler' indicators of compromise, including unexpected Rust backdoor binaries and PHP web shells on hosts, and review template/theme customizations for tampering. Exact fixed version numbers are not included in the available data, so consult Adobe's advisory for the correct patched release for your Commerce/Magento version line.	10.0	4%	KEV PoC

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2012-1823

PHP-CGI Query String Parsing Flaw Enables Unauthenticated Remote Code Execution

PHP, when the interpreter is exposed through the CGI (php-cgi) interface, mishandles query strings (CWE-20 improper input validation), allowing attackers to pass command-line switches such as -d and -s directly to the interpreter. A remote, unauthenticated attacker triggers the flaw by sending a crafted query string beginning with a dash (including URL-encoded forms) to any URL handled by php-cgi. Successful exploitation allows arbitrary code execution under the web server's privileges, as well as disclosure of script source code or phpinfo output, with no authentication required. Only deployments that invoke PHP via CGI/FastCGI (common in legacy shared hosting and bundled software stacks) are affected; PHP running as an Apache module or via PHP-FPM is not exposed. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25 with EPSS at 100%, indicating active in-the-wild exploitation; any ransomware association is not yet confirmed.

Do: Upgrade PHP to at least 5.3.13/5.4.3 or, preferably, a currently supported PHP branch, and stop exposing the php-cgi binary directly by moving to mod_php or PHP-FPM. As an interim mitigation, block or rewrite requests whose query string begins with a dash (e.g., -d, -s, or URL-encoded dash characters) and review web server logs for such patterns to detect prior exploitation.

—

100%

KEV

PHP Deployments running PHP through the CGI (php-cgi) interface at the time of disclosure; per public advisories this includes versions prior to 5.3.12/5.4.2, fixed

masshundreds of thousands of internet-exposed php-cgi endpoints (a subset of the tens of millions of PHP-powered websites)

—

KEV Mar 25, 2022

CVE-2019-11043

Buffer Overflow in PHP-FPM Enables Unauthenticated RCE on nginx Stacks

CVE-2019-11043 is a buffer overflow (CWE-120/CWE-787) in PHP's FastCGI Process Manager (PHP-FPM) affecting PHP 7.1.x before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11. In certain FPM configurations — commonly web servers such as nginx that split PATH_INFO via fastcgi_split_path_info without validating that the requested PHP script exists — an unauthenticated remote attacker can send a crafted request that makes PHP-FPM write past allocated buffers into the space reserved for FCGI protocol data. This corruption of the FastCGI protocol state allows the attacker to execute arbitrary code with the privileges of the PHP-FPM worker on the hosting web server. Anyone running a vulnerable PHP-FPM behind an affected configuration is exposed, including Linux distribution packages (Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, Red Hat Software Collections), Tenable.sc deployments, and QNAP NAS devices running vulnerable PHP. The flaw is being actively exploited in the wild — it is in CISA's KEV with known ransomware use (including campaigns such as NextCry targeting Nextcloud instances on Linux servers) — and a public proof-of-concept exploit exists, consistent with its 99.8% EPSS score.

Do: Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later (or apply your distribution's/vendor's patched packages — CISA's KEV required action is to apply updates per vendor instructions; QNAP users should apply QNAP's released updates). As an interim mitigation, harden the nginx fastcgi_split_path_info configuration (prefix the regex with '^' and use try_files to confirm the script exists) or disable PATH_INFO where it is not needed. Prioritize internet-facing web servers, shared hosting, and QNAP/Nextcloud instances for patching and check them for compromise, given active ransomware exploitation.

9.8

100%

KEV

CVE-2024-4577

OS Command Injection in Windows PHP-CGI Allows Remote Code Execution

CVE-2024-4577 is an OS command injection flaw (CWE-78) in Windows-based PHP when it runs in CGI mode, allowing arbitrary code execution on the server. It is triggered when attacker-supplied characters in HTTP requests are mishandled by Windows' character-encoding conversion as the OS invokes php-cgi, letting attackers inject command-line arguments to the PHP interpreter; this bypasses the decade-old fix for CVE-2012-1823. A successful attacker gains the ability to run arbitrary commands and code in the context of the web server. Affected systems are PHP running on Windows through the CGI interface; deployments that do not use PHP-CGI on Windows are not described as affected in the source data. Exploitation is active: the flaw was added to CISA KEV on 2024-06-12 with known ransomware use, and EPSS assigns roughly 100% probability of exploitation within 30 days.

Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use: upgrade Windows PHP-CGI deployments to a PHP release that fixes CVE-2024-4577 per PHP Group advisories, or stop using CGI mode on Windows (e.g., switch to FastCGI) and apply any vendor-recommended workarounds. Given known ransomware abuse, review web server access logs for exploitation attempts (notably %AD-encoded soft hyphens and injected -d/-s arguments in php-cgi query strings) and prioritize patching internet-facing Windows hosts.

9.8

100%

KEV ransomware PoC ×11

CVE-2026-103849

Unauthenticated template-injection RCE in Adobe Commerce

Adobe Commerce is affected by improper neutralization of special elements in a template engine (CWE-1336), a server-side template injection flaw. An unauthenticated remote attacker can trigger it over the network with no user interaction and low attack complexity. Successful exploitation can run arbitrary code in the context of the current user and, because scope is changed, can yield elevated access or control of a victim account or session, with high impact to confidentiality, integrity, and availability (CVSS 10.0). Storefronts running affected Adobe Commerce builds are at risk; the advisory data does not name version ranges. It is not listed in CISA KEV and no public proof-of-concept is known.

Do: Apply the Adobe security update for this CVE as soon as a fixed release is published, and confirm the installed Adobe Commerce build against Adobe’s bulletin rather than assuming a version range. Until patched, restrict unauthenticated access to storefront and admin template features where possible, review template and email-template configuration for unexpected changes, and monitor for anomalous process execution or session hijacking.

10.0

<1%

PoC

Adobe Commerce

large

CVE-2026-109619

+1 related CVE

CVE-2026-109618

PHP has various global state that temporarily points into request memory

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

NVD description · AI analysis pending

9.2

PoC ×7

php php

—

1d ago

CVE-2026-75650

Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650)

Adobe Commerce and Magento (including Adobe Commerce B2B) contain an improper neutralization of special elements used in a template engine (CWE-1336), a template-injection flaw that permits arbitrary code execution in the context of the current user. The flaw is reachable over the network by unauthenticated attackers, requires no user interaction, and its changed scope (CVSS 3.1 S:C) means injected code executes beyond the vulnerable component, producing a maximum-severity (CVSS 10.0) remote code execution condition. A successful attacker gains arbitrary code execution on the storefront server; in the observed campaign, intruders installed a Rust backdoor and a PHP web shell (dubbed 'StyleSmuggler') on compromised servers. Any organization running an Adobe Commerce, Adobe Commerce B2B, or Magento storefront is in scope, with internet-facing e-commerce deployments most exposed. Exploitation is confirmed in the wild: the bug was abused as a zero-day before patching and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08.

Do: Apply Adobe's released patches immediately per vendor instructions, prioritizing internet-facing Commerce/Magento storefronts, and ensure compliance with CISA BOD 26-04 timelines for KEV entries. Hunt for 'StyleSmuggler' indicators of compromise, including unexpected Rust backdoor binaries and PHP web shells on hosts, and review template/theme customizations for tampering. Exact fixed version numbers are not included in the available data, so consult Adobe's advisory for the correct patched release for your Commerce/Magento version line.

10.0

KEV PoC