PHP releases emergency patches for two critical PHP2Shell RCE flaws

· Cybersecurity

The PHP security team shipped out-of-cycle patches on October 21 for two critical remote code execution flaws tracked together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10. The fixes land in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; maintainers say only updating fully protects a server, because the widely circulated workaround setting is not sufficient on its own. Several security firms saw exploitation attempts hit their sensors before the patches were released, and hundreds of websites were taken offline amid the alarm. Details reportedly leaked ahead of the scheduled disclosure, forcing the PHP Foundation to publish earlier than planned. The foundation said one of the flaws dates to 2024, and that a recent third-party review by AI companies heightened attention on both bugs.

Why it matters：PHP underpins a large share of the web, so unauthenticated RCE flaws with leaked details and early exploitation attempts put pressure on every organization running self-managed servers to patch immediately.

Key points

  • The PHP Foundation moved up disclosure after exploit details leaked ahead of schedule.
  • The maintainers say the public workaround setting is not a substitute for patching.
  • Security firms recorded exploitation attempts before the fixes shipped.

Sources (original reporting)

More stories from this day