Amazon Threat Intelligence reports that attackers began targeting the two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on October 17, four days before PHP released fixes on October 21. The PHP team had to move up its disclosure timeline after details including the CVE IDs and mitigation guidance leaked online two days early, and researchers say functional exploits appeared within hours of the patch release.
bleepingcomputer.com
· 2026-10-22
GitLab has released patches for CVE-2026-110264, a critical integer overflow vulnerability in its Regular Expression Compiler that could allow unauthenticated attackers to execute arbitrary code on vulnerable servers. The flaw, reported by researcher 'joaxcar' via HackerOne, has been fixed in CE and EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated tenants on patched internal builds are already protected, but self-managed installations must upgrade immediately.
bleepingcomputer.com
· 2026-10-22
A security blogger argues that a newly disclosed PHP vulnerability, widely discussed online for roughly ten hours, lacks a functioning proof-of-concept despite thousands of 'PoC' exploit scripts appearing on GitHub. The author says none of these scripts actually work against a standard PHP server when tested directly, and contrasts the situation with past critical bugs like Log4Shell, Heartbleed and Shellshock, which were exploited within hours of disclosure.
eliastaylor.com
· 2026-10-21
Security researchers have disclosed two PHP flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP web runtimes, along with a suggested AWS WAF rule named 'PHP2Shell' to help block exploitation attempts. The rule targets POST requests that combine PHPSESSID cookie or body values with the PHP_SESSION_UPLOAD_PROGRESS parameter, a pattern associated with session-based remote code execution attacks against PHP applications.
aws.amazon.com
· 2026-10-21
Security firm Calif uncovered two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, that allow unauthenticated remote code execution via memory corruption and stale global state issues. WatchTowr researchers confirmed they could reproduce both flaws after a proof-of-concept tool called PHP2Shell leaked ahead of a planned coordinated disclosure, and PHP's maintainers have released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
darkreading.com
· 2026-10-21
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released to fix CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that could let unauthenticated attackers execute code on servers running PHP. One flaw involves memory corruption triggered when a request hits the memory_limit at a precise moment, while the other involves stale internal state left behind after a fatal error, both of which were shown to enable full remote code execution under common configurations like Apache with mod_php and PHP-FPM.
thephp.foundation
· 2026-10-21
The PHP Foundation released emergency updates on Wednesday to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let attackers remotely take control of affected systems. The flaws affect all PHP installations serving web requests dating back to PHP 5 from 2004, though only PHP 8.2 and newer will receive official patches, with some legacy fixes available through third-party vendors.
wired.com
· 2026-10-21
Security researchers at Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed php2shell, affecting all web servers running PHP 5.4 or later. Cloudflare says it deployed WAF protections for free and paid customers by October 21 at 3:02 am UTC, roughly nine hours before the public disclosure, after coordinating with the PHP Foundation, OpenAI and Wiz.
blog.cloudflare.com
· 2026-10-21
The PHP project has issued version 8.5.12 to patch two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let an attacker achieve unauthenticated remote code execution. One flaw stems from out-of-memory handling corrupting partially initialized request data, while the other involves stale internal state persisting across requests on the same worker. The advisory says all web-facing PHP setups are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php deemed highest risk since a working exploit can trigger before any application code runs.
techspot.com
· 2026-10-21
The PHP security team issued emergency updates fixing two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, found by researchers from Calif, Wiz, and OpenAI. Both bugs stem from memory corruption when requests end abnormally and affect nearly all PHP deployments that handle web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with limited source backports offered for older 7.4, 8.0, and 8.1 branches.
bleepingcomputer.com
· 2026-10-21
PHP maintainers announced Monday that patches for two vulnerabilities, each rated 9.2 out of 10 in severity, would be released within about 12 hours. The advisory followed leaked, unconfirmed details of an exploit tool called PHP2Shell demonstrated against popular PHP-based platforms including WordPress, Magento, Drupal, and Joomla. Security firm watchTowr said the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, appear to affect every PHP version since PHP 5 in 2004 and that it has confirmed they are genuine.
arstechnica.com
· 2026-10-21
The PHP project announced an upcoming security release fixing two critical vulnerabilities, each rated 9.2 on the CVSS v4.0 scale. The patch is planned for Wednesday, 21 October 2026 at 14:00 UTC, with the PHP security team urging users to prepare in advance.
news-web.php.net
· 2026-10-20
GoKawiil