criticallivepartial fix
chapter · Exploited before disclosure
PHP2Shell: critical unauthenticated RCE in PHP core
› PHP
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Exploited before disclosure
Honeypots saw exploitation attempts days before anything was public.
AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure.
## summary
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026; exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
read the full incident →## advisories[4]
- Today's PHP Security Release (PHP Foundation)PHP Foundation · Oct 21, 2026
- CISA: Critical Vulnerabilities in PHP Require Immediate PatchingCISA · Oct 21, 2026
- CERT-EU 2026-018: Critical Vulnerabilities in PHPCERT-EU · Oct 21, 2026
- Security advisory: Critical remote code execution vulnerabilities, update nowPHP · Oct 21, 2026
