chapter · Downstream vendors
PHP2Shell: critical unauthenticated RCE in PHP core
› PHP
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Downstream vendors
Products that bundle PHP ship their own advisories; some fixes lag the PHP release.
Distro packages: Debian shipped fixes on the evening of Oct 21; Fedora, Gentoo, Ubuntu and Red Hat followed, then Slackware and SUSE. heise says there are still no reports of successful attacks despite massive exploitation attempts.
sourceVendor roundup: Palo Alto Networks says upcoming PAN-OS releases will fix PHP2Shell (rated CVSS 8.7 for its products, workarounds published, no known attacks); Sophos took its legacy MyUTM portal offline after finding a vulnerable PHP; Cisco lists 30+ products under review with none known affected; Fortinet says two dozen products are not impacted and is still checking others. Ubuntu, Debian, cPanel, Plesk and DirectAdmin have shipped fixes.
sourceQNAP: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 / h6.0.x / h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus QuMagie, Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS are affected; fixed versions are still to be announced. EOL Download Station and the PHP extensions app won't be fixed, so uninstall them. Restrict NAS web access until firmware lands.
source
## summary
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
read the full incident →## advisories[6]
- Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilitiesAWS Security Blog · Oct 21, 2026
- Vulnerabilities in PHP (PHP2Shell) affecting multiple QNAP products (advisory repost)Forum NAS (QNAP advisory) · Oct 22, 2026
- Today's PHP Security Release (PHP Foundation)PHP Foundation · Oct 21, 2026
- CISA: Critical Vulnerabilities in PHP Require Immediate PatchingCISA · Oct 21, 2026
- CERT-EU 2026-018: Critical Vulnerabilities in PHPCERT-EU · Oct 21, 2026
- Security advisory: Critical remote code execution vulnerabilities, update nowPHP · Oct 21, 2026
