PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't

Live updates

1. 2h ago

   PHP Prepares Emergency Patches for PHP2Shell RCE Flaws

   PHP is scheduled to release emergency patches at 14:00 UTC for two critical remote code execution vulnerabilities collectively known as PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. Cybersecurity agencies and firms warn that web servers cannot be fully protected by single settings or workarounds alone before the official fix arrives. Cloudflare has deployed emergency managed rules as a stopgap measure, while authorities advise taking exposed systems offline or placing them behind access controls until updates can be applied.

   Why it matters

   The vulnerabilities affect the PHP runtime itself, creating severe risks for a vast share of web infrastructure. Because the flaws reside in core code, traditional firewalls and CDN workarounds provide incomplete protection, forcing administrators to scramble for mitigation strategies. Security agencies have issued urgent advisories urging immediate action to prevent potential remote command execution on unpatched servers.

   What is confirmed

   • PHP scheduled an emergency security release for October 21, 2026, at 14:00 UTC to address two critical flaws designated CVE-2026-109618 and CVE-2026-109619.
   • Both vulnerabilities carry a CVSS score of 9.2 out of 10.
   • Cloudflare released emergency WAF rules to detect anomalous request patterns targeting the flaws.

   Still unconfirmed

   • CISA added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.

   What to watch next

   • Deployment and application of the official PHP emergency patches following the 14:00 UTC release
   • Confirmation of whether public exploit code successfully compromises vulnerable servers
   • Further updates from cybersecurity authorities regarding active exploitation in the wild
   Sources used for this update (21)

   1. help.naver.com — Futures Flat As Oil Rebounds After Trump's "Energy Ceasefire" Unravels, Memory Stocks Slide | ZeroHedge
   2. Ars Technica — PHP warns it plans to release 2 emergency patches imminently
   3. Reuters — EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities
   4. The Hacker News — PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
   5. The Hacker News — PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
   6. National Cyber Security Centre — Critical security issue affecting PHP
   7. Aikido Security — Critical vulnerabilities in PHP | Stay tuned for php2shell mitigation and patches
   8. BBC — Cyber chiefs tell websites to make critical safety update or go offline
   9. thehackernews.com — PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
   10. builder.aws.com — Find It, Patch It, Watch It: A Community Checklist for php2shell on AWS | AWS Builder Center
   11. dev.to — How to Fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619) - DEV Community
   12. ipban.com — A WAF Is Not a PHP Version Upgrade – IPBan Pro
   confidence 90%