GoKawiilPHP patches two critical unauthenticated RCE flaws dubbed PHP2Shell
The PHP security team issued emergency updates fixing two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, found by researchers from Calif, Wiz, and OpenAI. Both bugs stem from memory corruption when requests end abnormally and affect nearly all PHP deployments that handle web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with limited source backports offered for older 7.4, 8.0, and 8.1 branches.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the flaws require no authentication and can execute before application code even runs, they could let attackers compromise a huge swath of internet-facing PHP servers with minimal effort, according to the PHP security team's own risk assessment. The decision to issue source backports for end-of-life versions suggests the team views the threat as severe enough to extend support beyond its normal policy. Organizations still running PHP 7.4 or earlier without vendor-backported fixes may face elevated exposure until they upgrade.
- Two critical unauthenticated RCE bugs, collectively called PHP2Shell, hit most PHP web-serving configurations.
- Patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; mod_php is considered highest risk.
- PHP also issued rare source backports for unsupported 7.4, 8.0, and 8.1 branches given the severity.
Source: bleepingcomputer.com, 2026-10-21
Published there as: “PHP ships emergency patches for critical PHP2Shell flaws”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.