PHP releases emergency patches for two critical 'PHP2Shell' remote code execution flaws
The PHP security team urged administrators to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; Cloudflare said it had seen early attack attempts and the UK's NCSC told organisations to patch or take systems offline.
The PHP project released emergency security updates on Wednesday 21 October for two critical vulnerabilities that can let an unauthenticated attacker run code on a web server, BleepingComputer reported. The flaws, CVE-2026-109618 and CVE-2026-109619, are tracked together as “PHP2Shell”.
According to the PHP security team, the flaws affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The team said it considers the risk highest for mod_php, where it demonstrated an exploit in which an unauthenticated request triggers the attack before any application code runs. Both flaws stem from PHP leaving memory in a corrupted state when a request ends abnormally. They were found by researchers from Calif, Wiz and OpenAI, BleepingComputer said.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team said PHP 8.1 and older no longer receive official updates, but it provided minimal source backports for PHP 7.4, 8.0 and 8.1. PHP core developer Gina Peter Banyard said no temporary mitigation fully blocks attacks and patching is the only permanent defence.
Cloudflare chief technology officer Dane Knecht said the company had seen early attacks targeting the flaws and had deployed firewall rules as a temporary measure. The UK National Cyber Security Centre urged organisations to update to the latest fixed version and said those unable to update or apply the temporary mitigations should consider taking systems offline until they are protected. CERT-EU also issued an advisory.
Sources
- PHP ships emergency patches for critical PHP2Shell flaws · BleepingComputer
- Critical security issue affecting PHP · UK National Cyber Security Centre
- Critical Vulnerabilities in PHP (security advisory 2026-018) · CERT-EU
- RCE via OOM corruption (GHSA-w8hw-w9fx-j79w) · PHP project on GitHub
Related coverage
All technology →
CISA urges immediate patching of PHP2Shell flaws in PHP, used by 69.3% of websites
US agency CISA told organisations to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and to take unpatchable systems offline. Cloudflare reported early attack attempts; CISA said it had not observed exploitation.
Chrome and Firefox block eight eMudhra certificate authorities after weak private keys are found
Google said anyone could have forged trusted HTTPS certificates using the compromised keys; it is also removing the emSign ECC Root CA - G3 from the Chrome Root Store on 27 October.
Albert Heijn restores website and app a week after cybersecurity incident
The Dutch supermarket chain says home deliveries will resume gradually from Friday 23 October and all online orders up to Thursday have been cancelled. It says there is no indication personal data was involved.
Crypto hacks cost $1.18 billion in third quarter, security firm Hacken says
Hacken counted 107 incidents from July to September, with losses up 55% from the previous quarter. It said most of the money was lost through suppliers, unapplied fixes or systems outside audits.
Qubic halts its network and Cysic suspends its bridge after weekend exploits
Qubic said 1,404 wallets were drained of about 2.94 trillion QU tokens. Cysic said 10 million CYS tokens were minted without authorisation through its bridge.
Nikkei says 1.83 million personal data items leaked after cloud account breach
The Japanese media group said stolen credentials were used to access a cloud service used for system development on 7 October.
