Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcritical

PHP ships emergency PHP2Shell patches as early attacks emerge

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP has patched two critical unauthenticated runtime flaws, while Cloudflare reports early attacks and some sites stay offline.

PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, both rated CVSS 9.2. The flaws can let unauthenticated attackers run code or read worker memory on web-facing PHP, with the highest risk on Apache mod_php, where a request can trigger a bug before application code runs. Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older are unsupported, though minimal source backports exist for 7.4, 8.0 and 8.1. Cloudflare says it saw attack traffic before disclosure and deployed default WAF rules. Exposure estimates conflict: CyberScoop cites more than 1.3 million hosts and a Shodan count near 1.9 million, while BleepingComputer cites a VirusTotal estimate above 5.1 million.

Key facts
  • Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  • Both flaws are rated CVSS 9.2; PHP says updating is the only complete fix.
  • PHP 8.1 and earlier are unsupported; source backports exist for 7.4, 8.0 and 8.1.
  • Cloudflare WAF rules went live October 21 at 3:02 a.m. UTC for free and paid plans.
  • watchTowr reported attempts but said they had not succeeded; CISA KEV did not list them.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Cloudflare WAF rules went live at 3:02 a.m. UTC. · Cloudflare Blog
  2. Oct 21, 2026PHP moved the emergency release from Thursday to Wednesday. · CyberScoop
  3. Oct 21, 2026watchTowr reported no in-the-wild exploitation as of 11:26 UTC. · The Hacker News
  4. Oct 21, 2026PHP published fixes for both critical runtime flaws. · Help Net Security

What each outlet adds

beyond the shared facts
  • Cloudflare BlogNames disclosers and the free and paid WAF rulesets.
  • CyberScoopGives the 1.3 million and Shodan host estimates.
  • The Hacker NewsNotes no CISA KEV listing and BambooHR and Nintendo outages.
  • The RecordSays watchTowr saw attempts that had not succeeded.
  • WIREDReports Finnish, French and Port of Rotterdam precautionary outages.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPPHP FoundationPHP GroupCloudflareWiz
Products
PHPWordPressDrupalJoomlaLaravelPHP-FPMApacheFrankenPHPLiteSpeedMagento
Victims
NintendoBambooHRnoyb
Organizations
CloudflareUK National Cyber Security CentreWizOpenAICalifNCSCwatchTowrDetectifyCISACalif.ioQuarkslabPHP project
Countries
United KingdomFinlandFranceNetherlandsGermanyJapanAustralia

Coverage

oldest first · one row per article · UTC
  1. · 9d ago Fortinet PSIRTFirst report

    PHP core OOM handling can lead to RCE, Fortinet PSIRT says

    CVE-2026-109618 is scored CVSS 9.8; the notice, also naming CVE-2026-109619, was revised on October 21.

  2. · 9d ago SecurityWeek

    Leaked PHP2Shell flaws may allow unauthenticated remote code execution

    CVE-2026-109618 and CVE-2026-109619 both score 9.2; WatchTowr and Huntress report no exploitation yet.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV