PHP Issues Emergency Patches for Two Critical Unauthenticated RCE Vulnerabilities as Mass Exploitation Begins
What happened
On 21 October 2026, the PHP project released emergency security updates for versions 8.2 through 8.5 to fix two critical unauthenticated remote code execution flaws known as PHP2Shell.
The Context
- Immediate in-the-wild exploitation: Hostile scans and exploit activity began within 19 minutes of disclosure after vulnerability details leaked prior to the official rollout.
- Surface area spans all standard setups: The vulnerabilities affect all server application programming interfaces, including mod_php and PHP-FPM, requiring teams to inspect underlying package builds rather than relying on standard version printouts.
- Shortened support runways: While patched releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are live, legacy branches face tighter lifecycles, with PHP 8.2 reaching full end-of-support on 31 December 2026.
The Number
of exploit attempts were logged by Cloudflare within hours of release, demonstrating how automated threat scans instantly target exposed web assets worldwide.
Takeaway
Expect engineering teams to prioritize automated container rebuild pipelines and disable vulnerable configurations while accelerating upgrades ahead of year-end PHP version retirements.
Community posts including AI/ML tutorials and news.
"Open platform where developers share AI learnings."
— A47 Editor
How to check your server has the php2shell patch
The PHP team released patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 21 October to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, collectively known as php2shell, which let unauthenticated attackers run code on servers and are al...
Consumer tech news, reviews, and buying guides for gadgets and electronics.
"TechRadar is known for comprehensive buying advice, hardware reviews, and consumer tech news targeted at mainstream audiences."
— A47 Editor
Experts reveal another major PHP2Shell bug — and it's not getting an emergency patch this time
The base TechRadar report covers a newly identified PHP2Shell bug that can enable remote code execution, but only under what the article describes as "unlikely" conditions, and this additional flaw is not receiving an emergency patch. The development...
Community posts including AI/ML tutorials and news.
"Open platform where developers share AI learnings."
— A47 Editor
PHP2Shell: What Remains After the Headlines?
The base article, PHP2Shell: What Remains After the Headlines?, fact-checks seven claims that circulated after disclosure of critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution during re...