GoKawiilCritical PHP flaws dubbed 'PHP2Shell' prompt emergency patches across supported branches
Security firm Calif uncovered two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, that allow unauthenticated remote code execution via memory corruption and stale global state issues. WatchTowr researchers confirmed they could reproduce both flaws after a proof-of-concept tool called PHP2Shell leaked ahead of a planned coordinated disclosure, and PHP's maintainers have released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the flaws require no login and only network access to a server, they could expose a large share of PHP-powered web infrastructure to takeover if left unpatched. The early leak of a working exploit tool before the scheduled disclosure window may give attackers a head start over organizations still working through upgrade or mitigation plans, especially those running unsupported PHP versions without an available patch.
- Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) allow unauthenticated remote code execution.
- A proof-of-concept exploit called PHP2Shell leaked before the planned coordinated disclosure, prompting urgent patching advice.
- Fixes are available only for supported PHP branches (8.2–8.5); older unsupported versions require upgrades or backported mitigations.
Source: darkreading.com — Alexander Culafi, 2026-10-21
Published there as: “'PHP2Shell' Bugs Signal Red Alert for Security Industry”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.