PHP Releases Emergency Patches for Two Critical Remote Code Execution Flaws Under Active Exploitation
What happened
The PHP development team issued emergency patches for two critical remote code execution vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, following active in-the-wild exploitation.
The Context
* High-severity exposure across core engines: Both vulnerabilities carry a CVSS v4.0 score of 9.2, allowing unauthenticated attackers to execute arbitrary code across environments running mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. * Rapid weaponization cycle: Attack attempts surfaced within 19 minutes of the public patch release, resulting in confirmed honeypot compromises and an intrusion at an unnamed European government entity. * Backport verification complexities: Standard version output checks often fail on Linux distributions that backport security fixes, requiring direct validation of package change logs, container image rebuilds, and full process restarts.
The Number
— the brief window between patch publication and the first recorded automated exploitation attempts targeting internet-facing PHP deployments.
Takeaway
Engineering teams will need to automate package changelog audits and enforce immediate service restarts to prevent background processes from running vulnerable code.
Community posts including AI/ML tutorials and news.
"Open platform where developers share AI learnings."
— A47 Editor
How to check your server has the php2shell patch
The PHP team released patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 21 October to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, collectively known as php2shell, which let unauthenticated attackers run code on servers and are al...
Consumer tech news, reviews, and buying guides for gadgets and electronics.
"TechRadar is known for comprehensive buying advice, hardware reviews, and consumer tech news targeted at mainstream audiences."
— A47 Editor
Experts reveal another major PHP2Shell bug — and it's not getting an emergency patch this time
The base TechRadar report covers a newly identified PHP2Shell bug that can enable remote code execution, but only under what the article describes as "unlikely" conditions, and this additional flaw is not receiving an emergency patch. The development...
Community posts including AI/ML tutorials and news.
"Open platform where developers share AI learnings."
— A47 Editor
PHP2Shell: What Remains After the Headlines?
The base article, PHP2Shell: What Remains After the Headlines?, fact-checks seven claims that circulated after disclosure of critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution during re...
Startup news with frequent AI coverage.
"Covers launches, funding, and product updates in AI."
— A47 Editor
PHP-ocalypse: How two critical web bugs almost broke the internet
Two critical vulnerabilities in the PHP programming language, which powers approximately 70% of websites globally, have raised alarms across the internet, prompting a rush to patch affected systems. These flaws, identified as remote code execution vu...
Science discoveries, research, and analysis.
"NPR is a nonprofit media organization offering thoughtful, in-depth journalism and storytelling, often with a liberal or progressive slant."
— A47 Editor
AI found the flaw. Hackers found the leak: The race to save 'PHP2SHELL'
AI has identified a vulnerability in PHP2SHELL, a critical component of internet architecture, prompting security researchers to act swiftly to address the issue. However, the news of this vulnerability leaked, allowing hackers to exploit the situati...