PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

Live updates

1. 53m ago

   PHP Issues Emergency Patches for Critical PHP2Shell Flaws

   Global security teams are rushing to update systems after the release of emergency patches for two critical remote code execution vulnerabilities affecting the core PHP language runtime. Tracked collectively as PHP2Shell and designated as CVE-2026-109618 and CVE-2026-109619, the unauthenticated flaws carry a CVSS score of 9.2. Exploit attempts and proof-of-concept code have emerged in the wild, targeting servers globally. Security advisories emphasize that updating the PHP runtime is the only way to fully protect servers, with the highest risk present on systems utilizing Apache mod_php.

   Why it matters

   The vulnerabilities reside directly within the PHP runtime rather than individual web applications, meaning websites can be compromised even if their custom code is entirely secure. The discovery prompted widespread global concern and emergency warnings from cybersecurity agencies as websites began shutting down or reporting targeted attacks. The PHP team accelerated its disclosure schedule following an information leak ahead of a planned rollout.

   What is confirmed

   • PHP released emergency updates fixing CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
   • Both vulnerabilities are rated 9.2 on the CVSS v4.0 scale and allow unauthenticated remote code execution.
   • The fixes are included in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

   Still unconfirmed

   • OpenAI's Patch the Planet program discovered the vulnerabilities using GPT-5.6 Sol.

   What to watch next

   • Deployment rates of the emergency PHP patches across enterprise environments
   • Further reports of widespread exploitation or automated attacks targeting unpatched servers
   Sources used for this update (16)

   1. wiz.io — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
   2. The Hacker News — PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
   3. BBC — Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb
   4. CNN — Websites shut down globally after AI finds a critical flaw affecting 70% of the internet
   5. New Scientist — Global race to update computers as AI discovers most disruptive hack yet
   6. www.latent.space — [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of ....
   7. www.clarin.com — PHP vulnerability 2026 explained: What happened with 'PHP2Shell', how it affects millions of sites, patches and what precautions y....
   8. blog.qualys.com — PHP2Shell: PHP Patches Two Critical RCE Vulnerabilities ...
   9. thehackernews.com — PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
   10. www.securityweek.com — PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeek
   11. tech.yahoo.com — PHP releases emergency fixes as some of the world's biggest websites say they were targeted by hackers - Yahoo Tech
   12. www.forrester.com — PHP2Shell Leak Sends Security Teams Scrambling
   confidence 95%