Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

PHP ships fixes for two critical PHP2Shell RCE flaws

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP patched CVE-2026-109618 and CVE-2026-109619 in 8.2–8.5 as firms report broad, largely unconfirmed exploitation attempts.

On October 21 the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 and called PHP2Shell. The engine bugs can allow unauthenticated remote code execution on PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed, and may expose memory; PHP says mod_php risk is highest. Calif, OpenAI and Wiz found them with AI assistance. A leak advanced disclosure, and Chainguard published images hours early. Amazon logged a honeypot attempt on October 17; later reports describe broad probing. WatchTowr has not seen successful compromise, and AWS says the earliest attempts’ effect on real systems is unclear. CMS updates do not fix PHP. Only 8.2 and newer have official patches; 7.4, 8.0 and 8.1 have source backports.

Key facts
  • Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  • CVE-2026-109618 is out-of-memory corruption; CVE-2026-109619 is stale worker state.
  • At least one flaw affects PHP releases back to version 5.4.
  • Amazon’s MadPot honeypot recorded an attempt on October 17.
  • Public proof-of-concept code circulated before the official fixes.
  • CISA urged immediate updates or taking exposed systems offline.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026Amazon honeypot logged a PHP2Shell exploitation attempt. · WIRED
  2. Oct 20, 2026Flaw details leaked ahead of the coordinated PHP release. · SecurityWeek
  3. Oct 21, 2026Chainguard published patched images at 07:41 UTC. · The Register
  4. Oct 21, 2026PHP disclosed the bugs and shipped fixed releases. · SecurityWeek
  5. Oct 22, 2026CISA urged updates to the four fixed PHP releases. · SecurityWeek

What each outlet adds

beyond the shared facts
  • WordfenceSays WordPress updates do not patch PHP itself.
  • SecurityWeekNames bug classes, early reporters, and no confirmed compromise.
  • The RegisterChainguard shipped images early; its CEO does not regret it.
  • The Hacker NewsGives the October 17 source address and ELLIO’s first sighting.
  • Infosecurity MagazineSays the planned patch day was October 21, not October 22.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPAmazonCloudflarePHP FoundationOpenAIPHP Group
Products
MadPotPHPWordPressDrupalJoomla
Malware
PHP2Shell
Organizations
Amazon Web ServicesWizCalifOpenAIPHP FoundationDutch National Cyber Security CentreUniversity of ViennaBeelzebubEllioRecorded FutureAmazonCISA
Countries
FranceNetherlandsAustriaUnited StatesAustraliaChinaRussia
AI models
GPT-5.6 SolGemini 4 Argon

Coverage

oldest first · one row per article · UTC
  1. · 9d ago WordfenceFirst report

    PHP patches two critical unauthenticated remote code execution flaws

    Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; WordPress updates do not patch PHP itself.

  2. · 9d ago SecurityWeek

    PHP patches PHP2Shell RCE bugs as exploit attempts hit sensors

    CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, are fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV