chapter · Emergency release
PHP2Shell: critical unauthenticated RCE in PHP core
› PHP
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Emergency release
PHP ships fixed releases on every supported branch; agencies urge immediate patching.
PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline.
## summary
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026; exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
read the full incident →## advisories[4]
- Today's PHP Security Release (PHP Foundation)PHP Foundation · Oct 21, 2026
- CISA: Critical Vulnerabilities in PHP Require Immediate PatchingCISA · Oct 21, 2026
- CERT-EU 2026-018: Critical Vulnerabilities in PHPCERT-EU · Oct 21, 2026
- Security advisory: Critical remote code execution vulnerabilities, update nowPHP · Oct 21, 2026
