PHP to Patch Two Critical RCE Flaws in Emergency Updates Tomorrow

WHO:

Wired - AWS analysts reported that at least one actor attempted to exploit PHP2Shell before public disclosure.

Techmeme - OpenAI said the PHP flaws “are among several significant vulnerabilities” it found and expects “similar findings to increase sharply.”

Techmeme - Cloudflare deployed web application firewall (WAF) mitigations for all free- and paid-tier customers.

Ars Technica - PHP plans to release emergency security patches.

Techmeme - The PHP development team plans to issue the updates; security researchers at watchTowr say the vulnerabilities are remote-code-execution (RCE) flaws.

Techmeme - The report is attributed to Lawrence Abrams of BleepingComputer.

WHAT:

Wired - AWS logged attempts to exploit PHP2Shell, which Wired described as being broadly exploited across the internet.

Wired - The PHP Foundation’s patches cover PHP 8.2 and newer; legacy deployments must rely on third-party vendors for fixes.

The PHP Foundation - PHP released the security patches a day earlier than planned after the CVE IDs began circulating online.

Techmeme - The PHP vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.

Techmeme - Cloudflare’s WAF mitigations were deployed by default for its customers.

Wall Street Journal - PHP disclosed that the PHP2Shell memory-management vulnerability affects up to 70% of websites.

PHP - PHP released fixes for two critical, unauthenticated remote-code-execution vulnerabilities; all web-serving deployments are affected.

PHP - The fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and PHP urged all users to update.

NBC News - Global authorities have recommended that websites temporarily go offline until the PHP vulnerabilities are fixed.

Techmeme - watchTowr said the exploit allegedly affects all versions since PHP 5.

Ars Technica - PHP plans to release two emergency patches.

Ars Technica - An unconfirmed report claims the PHP2Shell exploit remotely executes code on PHP sites.

Techmeme - The planned updates address two vulnerabilities, each rated 9.2.

Techmeme - The PHP security team warned administrators to prepare for emergency security updates.

WHEN:

Wired - AWS analysts said an actor began attempting exploitation on October 17, four days before public disclosure.

Techmeme - PHP 5 was released in 2004.

Techmeme - The article says the PHP development team plans to release the updates “tomorrow.”

WHY:

Techmeme - The updates are intended to address two critical vulnerabilities.

HOW:

Techmeme - Cloudflare deployed its WAF mitigations about nine hours ahead of public disclosure.

Wall Street Journal - The PHP2Shell vulnerability was discovered using GPT-5.6 Sol.

Ars Technica - The unconfirmed report describes PHP2Shell as an exploit that remotely executes code on PHP sites.

Techmeme - watchTowr researchers characterize the two vulnerabilities as RCE flaws.

(UPDATED October 22, 2026 04:09 UTC)

PHP has released emergency fixes for two critical vulnerabilities that can let attackers remotely run code on affected websites, with the PHP2Shell flaw potentially exposing as many as 70 percent of websites. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect web-serving deployments, and researchers say the exploit may reach back to PHP 5. AWS analysts recorded an attempted PHP2Shell attack before the vulnerabilities were publicly disclosed. The PHP Foundation issued patches earlier than planned after the vulnerability IDs began circulating online. Updates are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and users are urged to install them. Support for older versions depends on third-party vendors. Cloudflare has enabled web application firewall protections by default for free and paid customers. OpenAI says these PHP flaws are among several significant vulnerabilities it has found and expects similar discoveries to rise sharply.

(UPDATED October 21, 2026 20:11 UTC)

PHP has released emergency fixes for two critical vulnerabilities that could let attackers run code remotely on affected websites. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are unauthenticated and rated 9.2. One, known as PHP2Shell, could affect as many as 70 percent of websites, and researchers say the flaws may reach back to PHP 5. The fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the PHP Foundation urges users to update. The patches were released earlier than planned after the vulnerability identifiers began circulating online. They cover PHP 8.2 and newer, while older deployments may need fixes from third-party vendors. Cloudflare has enabled web application firewall protections by default for free and paid customers. OpenAI says the PHP flaws are among several significant vulnerabilities it has found, and expects similar discoveries to increase sharply.

(UPDATED October 21, 2026 17:12 UTC)

PHP has released emergency fixes for two critical security vulnerabilities that allow unauthenticated attackers to run code remotely on affected servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect web-serving deployments, and researchers say one exploit may reach versions dating back to PHP 5. PHP says its PHP2Shell vulnerability could affect up to 70 percent of websites. The patches arrived earlier than planned after the vulnerability identifiers began circulating online. Users are urged to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Cloudflare has also enabled web application firewall protections by default for customers on both free and paid plans. The company deployed those measures before the public disclosure. OpenAI said the PHP flaws are among several significant vulnerabilities it has found and expects similar discoveries to increase sharply.

(UPDATED October 21, 2026 16:09 UTC)

PHP has released fixes for two critical, unauthenticated vulnerabilities that could let attackers run code remotely on affected websites. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect web-serving deployments, and PHP says the PHP2Shell memory-management issue may affect up to 70 percent of websites. Security researchers at watchTowr say the vulnerabilities reach back to PHP 5, though the reported scope has not been confirmed. The fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and PHP is urging users to update. Cloudflare has also enabled web application firewall protections by default for customers on both free and paid plans. OpenAI says the flaws are among several significant vulnerabilities it has found and expects similar discoveries to rise sharply. Global authorities have recommended that websites temporarily go offline until they are patched.

(UPDATED October 21, 2026 15:03 UTC)

PHP released fixes for two critical vulnerabilities that could let attackers run code remotely without authentication, and the flaws affect all web-serving deployments. One of them, called PHP2Shell, is a memory-management vulnerability that could affect up to 70% of websites and was discovered using GPT-5.6 Sol. The updates are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and PHP urged users to update.

(UPDATED October 21, 2026 14:05 UTC)

Global authorities are recommending that websites temporarily go offline until PHP vulnerabilities are fixed. The guidance is aimed at limiting exposure while the flaws remain unpatched. Website operators are being urged to stay offline until they can secure their systems.

(UPDATED October 21, 2026 06:01 UTC)

watchTowr says the exploit allegedly affects every version of PHP dating back to PHP 5. PHP 5 was released in 2004. The claim covers all versions since that release.

(UPDATED October 21, 2026 05:08 UTC)

PHP is preparing two emergency security patches for critical vulnerabilities, each rated 9.2, and its security team has urged administrators to get ready for the updates. Researchers at watchTowr describe the flaws as remote-code-execution vulnerabilities, while an unconfirmed report says the PHP2Shell exploit can run code remotely on PHP websites. The development team plans to release the updates tomorrow, according to a report attributed to Lawrence Abrams of BleepingComputer.