criticallivepartial fix
chapter · Embargo leak and disclosure
PHP2Shell: critical unauthenticated RCE in PHP core
› PHP
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Embargo leak and disclosure
The embargo leaks and the two CVEs are confirmed publicly.
Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC.
## summary
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026; exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
read the full incident →## advisories[4]
- Today's PHP Security Release (PHP Foundation)PHP Foundation · Oct 21, 2026
- CISA: Critical Vulnerabilities in PHP Require Immediate PatchingCISA · Oct 21, 2026
- CERT-EU 2026-018: Critical Vulnerabilities in PHPCERT-EU · Oct 21, 2026
- Security advisory: Critical remote code execution vulnerabilities, update nowPHP · Oct 21, 2026
