Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches

Live updates

1. 1h ago

   Critical PHP2Shell Flaws Trigger Emergency Patches After Leak

   PHP has released emergency updates to fix two critical remote code execution vulnerabilities, collectively designated PHP2Shell, that carry a CVSS score of 9.2. The security team pushed out the patches after vulnerability details leaked on Hacker News a day ahead of their scheduled October 21 disclosure. The flaws reside directly in the PHP runtime core rather than third-party applications, leaving servers exposed even when custom site code is secure. An EU agency warned that some websites may need to be taken offline while administrators apply the fixes.

   Why it matters

   Artificial intelligence tools initially helped uncover these deep-seated software weaknesses in the programming language that powers a vast share of the internet. However, the premature leak of technical details accelerated exploit timelines, catching web administrators off guard and prompting urgent maintenance across the web. The highest risk applies to servers utilizing Apache mod_php, where successful exploits can trigger attacks before application code even executes.

   What is confirmed

   • PHP released emergency updates fixing two critical remote code execution flaws designated CVE-2026-109618 and CVE-2026-109619.
   • Both vulnerabilities carry a CVSS score of 9.2 and are collectively referred to as PHP2Shell.
   • The emergency patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
   • Information regarding the flaws leaked on the social news site Hacker News ahead of the planned October 21 disclosure.

   Still unconfirmed

   • Attack attempts began against the vulnerabilities even before public disclosure.

   What to watch next

   • Widespread reporting on active mass exploitation campaigns leveraging the PHP2Shell vulnerabilities
   • Further advisories from cybersecurity agencies regarding mandatory website offline maintenance
   Sources used for this update (21)

   1. news.sbs.co.kr — South Korea Recalls Ambassador to Ukraine in Tough Response to POW Repatriation Dispute
   2. Ars Technica — PHP warns it plans to release 2 emergency patches imminently
   3. Reuters — EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities
   4. The Hacker News — PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
   5. Infosecurity Magazine — Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
   6. WSJ — Exclusive | AI Just Found A Bug That Puts Up to 70% of the World’s Websites at Risk
   7. www.archyde.com — Global Cyber Security Alert: Critical PHP Vulnerabilities Found – Archyde
   8. www.infosecurity-magazine.com — Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
   9. www.bleepingcomputer.com — PHP warns admins of two critical flaws, emergency patches coming tomorrow - BleepingComputer
   10. www.securityweek.com — PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws - SecurityWeek
   11. lorikeetsecurity.com — php2shell: Inside the Leaked Critical PHP Flaws Triggering ...
   12. www.criticalstart.com — PHP2SHELL RCE Vulnerabilities - criticalstart.com
   confidence 95%