PHP2Shell: critical PHP RCE flaws CVE-2026-109618/109619 patched; broad exploitation attempts, European sites offline

Linha do tempo

1. tenable.com ↗ · pub. 22/10/2026 19:04 · coletado 22/10 20:00

   Criminal forums including BreachForums go offline over PHP2Shell RCE flaws CVE-2026-109618 and CVE-2026-109619

   Tenable adds the underground reaction: BreachForums, DarkForums, PwnForums and Dread went offline or migrated, citing PHP2Shell, and it forecasts commoditization of the exploits by access brokers and ransomware affiliates. Its claims that all PHP versions below 8.3 are affected and that 8.2 and older get no patches conflict with the known report of fixed 8.2.35 and backports for 7.4, 8.0 and 8.1.

   ler a análise desta fonte ocultar

   Tenable adds the underground reaction: BreachForums, DarkForums, PwnForums and Dread went offline or migrated, citing PHP2Shell, and it forecasts commoditization of the exploits by access brokers and ransomware affiliates. Its claims that all PHP versions below 8.3 are affected and that 8.2 and older get no patches conflict with the known report of fixed 8.2.35 and backports for 7.4, 8.0 and 8.1.

   Tenable reports that criminal forums took themselves offline or migrated infrastructure after the public disclosure of PHP2Shell, two critical unauthenticated RCE flaws in PHP (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2 each). BreachForums posted an advisory saying "We take our security seriously", DarkForums said it would stay offline until PHP is patched globally, PwnForums went dark, and Dread posted a maintenance notice naming both CVEs. Some forums restricted registrations or moved key communications to Telegram. Tenable argues that operators face a dual threat from law enforcement and rival groups, because forum PHP stacks hold member emails, IP logs, private messages, transaction records and stolen credentials. It also reports pre-disclosure exploitation from October 17 from an Australian-geolocated IP and forecasts that initial access brokers and ransomware affiliates will commoditize the exploits.

   Technical Details

   • The two flaws target different stages of PHP's memory management (OOM Corruption and Stale Global State). Chaining them gives a more reliable exploitation path, and researchers credit frontier AI models with the discovery and the chain.
   • Tenable states the flaws affect every PHP version below 8.3, that about 59% of internet-facing PHP hosts run end-of-life branches, and that no patches will be issued for PHP 5.x, 7.x, 8.0, 8.1 and 8.2.
   • Researchers have documented AI-assisted vulnerability analysis being used to speed up exploit development and to find additional exploitation vectors.
   • DarkOwl analysis highlights the data held behind a typical forum's PHP application layer.

   Remediation

   • Treat both CVEs as immediate remediation priorities and upgrade PHP.
   • Where upgrading is not feasible, deploy compensating controls: a WAF, network segmentation and enhanced monitoring for exploitation indicators.
   • Tenable plugins are being released on the individual CVE pages.
2. theregister.com ↗ · pub. 22/10/2026 17:37 · coletado 22/10 18:00

   VulnCheck develops PHP2Shell exploit that bypasses ASLR for RCE on x86-64 PHP 8.4.26 in production configuration

   VulnCheck reports a working exploit for CVE-2026-109618 that bypasses ASLR on x86-64 systems with PHP's recommended production configuration (display_errors=off), chaining a memory leak into RCE on PHP 8.4.26. This contrasts with earlier reports that circulating PoCs were non-functional. The exploit is restricted to VulnCheck's Initial Access Intelligence customers, does not yet work for RCE on ARM64, and VulnCheck says hundreds of GitHub PoC repositories exist but very few work.

   ler a análise desta fonte ocultar

   VulnCheck reports a working exploit for CVE-2026-109618 that bypasses ASLR on x86-64 systems with PHP's recommended production configuration (display_errors=off), chaining a memory leak into RCE on PHP 8.4.26. This contrasts with earlier reports that circulating PoCs were non-functional. The exploit is restricted to VulnCheck's Initial Access Intelligence customers, does not yet work for RCE on ARM64, and VulnCheck says hundreds of GitHub PoC repositories exist but very few work.

   VulnCheck says it has developed what it believes is the first known exploit to achieve remote code execution (RCE) for CVE-2026-109618, part of the PHP2Shell pair with CVE-2026-109619, on ASLR-enabled x86-64 systems using PHP's recommended production configuration. The exploit chains a confirmed memory leak into RCE on PHP 8.4.26, and it works with display_errors=off. VulnCheck has made it available only to its Initial Access Intelligence customers. The company says ASLR had been the main barrier to exploiting PHP2Shell on real-world servers, and Spencer McIntyre warns that adversaries are clearly spending time (and AI tokens) on the bug. VulnCheck has seen hundreds of PHP2Shell proof-of-concept repositories on GitHub, but very few contain working exploits. Defenders are urged to patch rather than rely on memory protections.

   Technical Details

   • Target: CVE-2026-109618, an out-of-memory corruption bug leading to RCE in PHP; the PHP Foundation disclosed and patched it, together with CVE-2026-109619, on Wednesday.
   • The technique chains a confirmed memory leak into RCE on PHP 8.4.26 and defeats ASLR on x86-64 with display_errors=off.
   • VulnCheck says it works on ARM64 as well, but the RCE is not currently functional on ARM-based systems.
   • VulnCheck says it has not identified another public or commercial exploit that achieves this under the same conditions.

   Remediation

   • Organizations running vulnerable PHP versions should prioritize patching rather than assume that existing memory protections (ASLR) or configuration changes will stop an attack.
3. blog.checkpoint.com ↗ · pub. 22/10/2026 14:15 · coletado 22/10 15:00

   PHP2Shell: CVE-2026-109618 and CVE-2026-109619 PHP RCE flaws actively exploited, hitting 10% of organizations worldwide

   ler a análise desta fonte ocultar

   Check Point Research reports active exploitation of two critical PHP engine vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Details leaked ahead of planned disclosure, and screenshots of a PHP2Shell attack tool are circulating. Since the leak, 10% of organizations worldwide have been "impacted", meaning exploitation attempts were observed; Check Point cannot confirm whether any attack succeeded. Europe is hit hardest (14% versus 6% in North America, Latin America and APAC), with Hungary (38%), Denmark (32%) and Austria (28%) the most affected countries. Government institutions in the Netherlands and Finland have taken some websites offline as a precaution.

   Technical Details

   • The flaws are in the PHP engine itself, so they affect any stack built on it: WordPress, Drupal, Joomla, Magento, shared hosting, cPanel and Plesk, and many commercial applications.
   • An unauthenticated remote attacker can execute code on a vulnerable server, leading to data theft, lateral attacks or outages.
   • Exploitation activity peaks hourly at midnight, when fewer security teams are watching.
   • The most exposed sectors are telecommunications (20%), education (18%), media and entertainment (16%) and associations and non-profits (16%). Biotech and pharmaceuticals is lowest (5%) among the 23 industries tracked.
   • Updating a CMS or its plugins does not close the flaws; PHP must be updated on the server.
   • Indicators of compromise to hunt for: unexplained web service outages, new or unfamiliar PHP files, unusual web server requests, web server processes executing system commands, and connections to unknown external addresses.

   Remediation

   • Update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. PHP 8.1 and older remain vulnerable unless the fix is backported.
   • Inventory all PHP instances, including containers and third-party products. Patch internet-facing systems first, then restart services and verify the patched version is running.
   • Confirm with hosting providers that the patch has been applied.
   • Where patching is not immediately possible, restrict access to or temporarily take the vulnerable service offline, and segment web servers from the corporate network.
   • Patching does not remove malicious code already planted, so check for compromise.
   • Check Point offers IPS and WAF protections (latest signatures in Prevent mode) and Exposure Management to map PHP exposure.
4. theregister.com ↗ · pub. 22/10/2026 13:05 · coletado 22/10 15:00

   PHP2Shell forces 32 UK government services offline and 4 partly offline; no confirmed compromise

   UK minister Baroness Lloyd of Effra told the House of Lords that 32 UK government services are unavailable and four partially unavailable as a precaution, with no confirmed compromise of central government or the wider public sector. Disruption includes the OBR, reportedly the DVLA, police services and several councils, and government sites in Germany, France, Belgium, Finland, the Netherlands and Australia's cyber agency site were also taken offline. The NCSC was briefed by OpenAI a week earlier and sent 50,000 warnings, and the NSA urged organizations to patch or disconnect.

   ler a análise desta fonte ocultar

   UK minister Baroness Lloyd of Effra told the House of Lords that 32 UK government services are unavailable and four partially unavailable as a precaution, with no confirmed compromise of central government or the wider public sector. Disruption includes the OBR, reportedly the DVLA, police services and several councils, and government sites in Germany, France, Belgium, Finland, the Netherlands and Australia's cyber agency site were also taken offline. The NCSC was briefed by OpenAI a week earlier and sent 50,000 warnings, and the NSA urged organizations to patch or disconnect.

   The PHP2Shell flaws have forced 32 UK government services offline and left four partially unavailable, according to tech minister Baroness Lloyd of Effra in the House of Lords on October 22, 2026. She said the outages largely stem from precautionary measures while security updates and mitigations are applied, and that the government is not aware of any confirmed compromise of central government systems or the wider public sector. The Office for Budget Responsibility is among those offline, and reports cite disruption at the DVLA, police services and councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet. Government sites in Germany, France, Belgium, Finland and the Netherlands, and Australia's cybersecurity agency website, were also taken down as a precaution. AWS says attacks began four days before disclosure, and Cloudflare has recorded millions of weaponization attempts.

   Technical Details

   • CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution on vulnerable PHP servers.
   • One bug was found by Calif using OpenAI's GPT-5.6 Sol model; Wiz separately found both flaws with AI tools. OpenAI then analysed them and worked with vendors and agencies on disclosure.
   • The NCSC was briefed by OpenAI the week before disclosure, and the government set up a cross-departmental incident response before the public announcement.

   Remediation

   • The NCSC urges organizations to patch immediately or take affected systems offline until they are fixed, and sent 50,000 warnings to businesses and other organizations.
   • The NSA urges organizations to patch or disconnect vulnerable systems.
   • Departments are restoring services after remediation work.
5. gbhackers.com ↗ · pub. 22/10/2026 13:13 · coletado 22/10 15:00

   Gcore offers free WAAP Enterprise to public agencies after php2shell PHP RCE flaws (CVE-2026-109618/109619) take European sites offline

   ler a análise desta fonte ocultar

   Gcore is offering its WAAP Enterprise plan free to government bodies and public agencies until December 31, 2026. The offer follows the php2shell vulnerabilities, which forced public websites offline across Europe this week. Government portals in the Netherlands, Finland, Denmark and France, along with hospitals, schools and commercial sites, were taken down on the advice of CERT-EU and national agencies. The two PHP flaws, CVE-2026-109618 and CVE-2026-109619, are rated CVSS 9.2 and allow unauthenticated remote code execution before any application code runs. The article is a vendor press release, so Gcore's claims about its own product's protection are unverified.

   Technical Details

   • The php2shell flaws allow unauthenticated RCE in PHP, before application code executes.
   • Gcore states its WAAP blocks the php2shell attack path by default for all customers, and updates rules centrally if new variants appear.
   • Fixed PHP versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1 and older receive no official fix.
   • The article does not state whether the flaws are exploited in the wild. The sites went offline as a precaution while no fix existed.

   Remediation

   • Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM and long-running workers.
   • For PHP 8.1 and older, obtain a vendor backport or upgrade.
   • Restrict origin access so traffic reaches the server only through a protection layer such as a WAF/WAAP.
   • Sites taken offline can be placed behind a filtering layer and restored while patching continues.
6. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 22/10 13:01

   CERT-FR flags multiple PHP vulnerabilities enabling remote code execution, fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12

   ler a análise desta fonte ocultar

   CERT-FR advisory CERTFR-2026-AVI-1359 reports multiple vulnerabilities in PHP that allow an attacker to achieve remote arbitrary code execution. The flaws are addressed in the PHP security bulletins of 21 October 2026. All 8.0.x and 8.1.x versions are listed as affected, and since the advisory names no fixed release for these branches, they appear to be end-of-life. The advisory does not mention active exploitation, IOCs or attribution.

   Technical Details

   • Affected: PHP 8.0.x (all versions), 8.1.x (all versions), 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27 and 8.5.x before 8.5.12.
   • Referenced CVEs: CVE-2026-109618 and CVE-2026-109619.
   • Vendor references: four php.net announcements dated 21 October 2026 and the GitHub advisories GHSA-6wmf-4rv5-p3rp and GHSA-w8hw-w9fx-j79w.
   • The advisory gives no CVSS scores, vulnerability classes or attack vectors, and does not map the impact to individual CVEs.

   Remediation

   • Consult the PHP security bulletin of 21 October 2026 and upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or later.
   • Installations running PHP 8.0.x or 8.1.x have no listed fix and should be migrated to a supported branch.
7. securityaffairs.com ↗ · pub. 22/10/2026 11:55 · coletado 22/10 13:00

   AWS: PHP2Shell exploit attempts hit MadPot honeypots four days before CVE-2026-109618/109619 disclosure

   AWS's own report (via securityaffairs.com) adds five further IP addresses seen on October 21 beyond 103.216.220.92, a warning that some are shared anonymization infrastructure that should not be blocked blindly, and mitigation guidance: no configuration-only workaround exists, blocking multipart uploads may be an interim measure, and defenders should hunt for POST requests containing PHP_SESSION_UPLOAD_PROGRESS and for logs from October 17 onward.

   ler a análise desta fonte ocultar

   AWS's own report (via securityaffairs.com) adds five further IP addresses seen on October 21 beyond 103.216.220.92, a warning that some are shared anonymization infrastructure that should not be blocked blindly, and mitigation guidance: no configuration-only workaround exists, blocking multipart uploads may be an interim measure, and defenders should hunt for POST requests containing PHP_SESSION_UPLOAD_PROGRESS and for logs from October 17 onward.

   Amazon Threat Intelligence reports that attackers tried to exploit the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) on October 17, 2026, four days before public disclosure and while the bugs were under embargo. The first attempt appeared in MadPot honeypot telemetry and came from an IP address tied to a commercial anonymization network. On October 21, further proof-of-concept exploits arrived from varied anonymized infrastructure starting around 02:00 UTC, about 12 hours before the 14:00 UTC release, and payloads differed, which suggests multiple actors. After PHP shipped the fixes, more PoCs followed within hours and AWS describes PHP2Shell as broadly exploited in the wild. AWS has not established how the actors learned of the flaws early, and it has not confirmed that any of the attempts would have succeeded against real systems.

   Technical Details

   • PHP2Shell is two critical PHP runtime flaws that allow unauthenticated RCE through a crafted web request. They affect PHP itself, not a specific application, so updating WordPress or Drupal does not fix them.
   • AWS recommends hunting for POST requests containing PHP_SESSION_UPLOAD_PROGRESS in multipart form data, unexpected processes launched by PHP (such as command interpreters), and unexplained file changes on web servers.
   • AWS published six IPs: 103.216.220.92 (October 17) and 31.223.184.166, 37.19.200.5, 134.209.159.64, 103.114.163.188, 95.217.98.37 (all October 21). Some belong to shared anonymization infrastructure, so matching events should be investigated rather than blindly blocked.
   • Cloudflare said it deployed WAF protections before disclosure and saw attackers changing payloads to evade them.

   Remediation

   • Install the fixed releases PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the update from your hosting provider, OS vendor or container image supplier. AWS says no configuration-only workaround fully covers both flaws.
   • If patching is not immediately possible, consider blocking multipart file uploads after assessing application impact. This does not replace patching.
   • Review logs and activity from October 17 onward, including behavior that detection tools may not yet recognize. A WAF reduces exposure but does not replace patching.
8. securityweek.com ↗ · pub. 22/10/2026 09:20 · coletado 22/10 11:00

   PHP2Shell: vendors and governments respond to critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619

   The article adds the industry and government response: Cisco's review of over 30 products with none known affected, Red Hat's lower 8.1 score, Palo Alto's 8.7 rating, Sophos taking its MyUTM portal offline, CrowdStrike's single-request mod_php confirmation, Coalition honeypot data, Qualys' mitigation, and distro, hosting-panel and cloud patches. It also adds Cisco Talos' estimate that about half of PHP systems will not be patched and further government guidance (NCSC, CERT-EU, Cyber Centre, BSI).

   ler a análise desta fonte ocultar

   The article adds the industry and government response: Cisco's review of over 30 products with none known affected, Red Hat's lower 8.1 score, Palo Alto's 8.7 rating, Sophos taking its MyUTM portal offline, CrowdStrike's single-request mod_php confirmation, Coalition honeypot data, Qualys' mitigation, and distro, hosting-panel and cloud patches. It also adds Cisco Talos' estimate that about half of PHP systems will not be patched and further government guidance (NCSC, CERT-EU, Cyber Centre, BSI).

   Tech vendors, security companies and government agencies have published advisories, detections and mitigations for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), two critical bugs that can let unauthenticated attackers execute code remotely. Wiz, OpenAI and Calif found them in August, and PHP fixed them on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, a day ahead of plan after the CVE IDs leaked on October 20. Amazon saw the first exploitation attempt on October 17, while Hadrian, Patchstack and Cloudflare detected attacks before the patches. WatchTowr saw mass exploitation soon after the fixes, although the circulating PoCs did not achieve code execution. Many vendors are still checking whether their products embed a vulnerable PHP runtime.

   Technical Details

   • Cisco is reviewing over 30 products and cloud services (ISE, Catalyst Center, Catalyst SD-WAN Manager, Expressway, Umbrella, Webex, AppDynamics PHP Agent) and says no products are currently known to be affected. Cisco Talos published Snort coverage, including Community Ruleset rules.
   • Red Hat scores both bugs 8.1 instead of NVD's 9.8 and does not rate them critical. For CVE-2026-109618 it says reliable exploitation requires precise heap manipulation and timing, and RCE typically requires non-default behavior.
   • Palo Alto Networks rates the impact on its products high (CVSS 8.7) and knows of no attacks against them. Fortinet confirmed two dozen products, including FortiOS, FortiManager, FortiAnalyzer and FortiWeb, are not impacted. Broadcom has confirmed no Enterprise Security Group product as affected.
   • Sophos found its legacy MyUTM licensing portal for the end-of-life SG UTM product was running a vulnerable PHP version and took it offline on October 21.
   • SolarWinds says Pingdom uses PHP but is protected by compensating controls.
   • CrowdStrike confirmed through testing that a single unauthenticated POST request makes an Apache mod_php worker start a shell and run an attacker-chosen command, with no vulnerable application code required.
   • Coalition honeypots logged matching exploit requests between October 20 and 21. JFrog warned of fake PoCs around disclosure.
   • Corelight released open-source Zeek and Suricata detections; Broadcom (Symantec/Carbon Black), CrowdStrike (Falcon Next-Gen SIEM) and others added detection content.

   Remediation

   • Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Cisco Talos estimates about half of PHP systems will not get a patch and urges anyone on PHP 8.1 or earlier to move to 8.2 or newer.
   • Ubuntu shipped fixes for all supported releases and Debian for bookworm and trixie. cPanel, Plesk and DirectAdmin shipped patches, and cPanel and Plesk also released builds for end-of-life PHP 7.4, 8.0 and 8.1. AWS is addressing Elastic Beanstalk, WorkMail, Amazon Linux and Lightsail. Google Cloud App Engine runtimes were updated automatically.
   • Qualys released a mitigation that disables PHP's session upload-progress feature on affected hosts.
   • CISA urges immediate patching starting with internet-facing systems. The UK NCSC says discovery should cover every PHP installation and recommends hunting for backdoors planted before patching. CERT-EU urges isolating internet-facing applications until the fix is verified. Canada's Cyber Centre and Germany's BSI issued alerts, and the Dutch NCSC tracks affected PHP-dependent software on GitHub.
9. bleepingcomputer.com ↗ · pub. 22/10/2026 10:09 · coletado 22/10 11:00

   Amazon: PHP2Shell exploitation began Oct 17, four days before PHP patched CVE-2026-109618 and CVE-2026-109619

   Amazon says payloads and anonymization infrastructure varied across the attempts, suggesting multiple actors, and that technical analysis is ongoing. It says attackers deployed multiple PoC exploits hours after disclosure from VPN IP addresses. VirusTotal tracks more than 5.1 million exposed PHP hosts, about 3.8 million with an open port. The PHP team says none of the PoCs published before the patches were functional.

   ler a análise desta fonte ocultar

   Amazon says payloads and anonymization infrastructure varied across the attempts, suggesting multiple actors, and that technical analysis is ongoing. It says attackers deployed multiple PoC exploits hours after disclosure from VPN IP addresses. VirusTotal tracks more than 5.1 million exposed PHP hosts, about 3.8 million with an open port. The PHP team says none of the PoCs published before the patches were functional.

   Amazon Threat Intelligence reports that attackers began targeting the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) on October 17, 2026, four days before the PHP security team shipped patches on October 21. Both are critical remote code execution (RCE) vulnerabilities. AWS CISO CJ Moses says the first attempt hit a honeypot from an IP address on a commercial anonymization network during the embargo, and that payloads and anonymization infrastructure varied, which suggests multiple actors. How the actor obtained exploit details before disclosure is unclear. Moses says the flaws are now broadly exploited in the wild and warns defenders not to assume the disclosure date is the earliest date of exploitation.

   Technical Details

   • The first exploitation attempts came on Saturday, October 17. Attackers then deployed multiple proof-of-concept exploits hours after disclosure from VPN IP addresses (Amazon).
   • Amazon says technical analysis is ongoing and it is unclear whether any attempt would have succeeded against real-world systems.
   • Cloudflare, watchTowr, Previdian, Hadrian and Patchstack detected unsuccessful exploitation attempts before public disclosure.
   • Details leaked online two days before the coordinated disclosure (including both CVE IDs and mitigation advice given to some critical infrastructure providers), so PHP moved its release up to October 20-21. The PHP security team says the PoCs published before the patches were not functional.
   • VirusTotal tracks more than 5.1 million PHP hosts exposed online, about 3.8 million of them with at least one port open.

   Remediation

   • Apply the official PHP security patches, which PHP core developer Gina Peter Banyard calls the only permanent defense.
   • The UK NCSC asked UK organizations to update PHP servers immediately or take them offline until they can be patched.
10. hacktron.ai ↗ · pub. 21/10/2026 21:00 · coletado 22/10 10:00

    PHP2Shell: PHP patches critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619 with exploitation attempts reported

    This article adds PHP 8.6.0 release candidates before RC4 to the affected versions, the earliest affected code path (PHP 5.4.0, per Tenable citing Calif), the confirmation that CVE-2026-109619 was validated as RCE on a normal dynamic PHP-FPM pool, the KEV status (not listed as of version 2026.10.21), the reporter handles credited in PHP's advisories, and a detailed list of administrative interim mitigations and hunting guidance.

    ler a análise desta fonte ocultar

    This article adds PHP 8.6.0 release candidates before RC4 to the affected versions, the earliest affected code path (PHP 5.4.0, per Tenable citing Calif), the confirmation that CVE-2026-109619 was validated as RCE on a normal dynamic PHP-FPM pool, the KEV status (not listed as of version 2026.10.21), the reporter handles credited in PHP's advisories, and a detailed list of administrative interim mitigations and hunting guidance.

    PHP released fixes on 21 October 2026 for two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell (CVSS v4.0 9.2). They affect PHP 8.2 to 8.5 before 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and PHP 8.6.0 release candidates before RC4, when serving web requests. Independent analysis traces the earliest affected code path to PHP 5.4.0. Exploitation attempts are reported, including AWS observations from 17 October, but as of 22 October no successful compromise of a real-world victim has been publicly documented and the flaws are not in CISA's KEV catalog (version 2026.10.21). Apache with mod_php carries the highest risk.

    Technical Details

    • CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): RCE via out-of-memory corruption. PHP exits OOM errors with longjmp(), so if memory runs out while request state is only partly initialised, shutdown can read or branch on invalid memory. It is reachable through request input handling, including multipart parsing.
    • CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): RCE via stale global state. Request-owned data stays in worker globals after its memory is freed, and a later request on the same worker can use it before normal initialisation. Confirmed early consumers are INI diagnostics and session upload progress. Impact is use-after-free, memory disclosure and RCE with the web worker's privileges.
    • Both are unauthenticated and network-reachable (AV:N/AC:H/AT:P/PR:N/UI:N). Reliability depends on the build, extensions, frontend and memory allocator layout.
    • Mod_php: RCE confirmed for both CVEs, and for CVE-2026-109618 with default input and memory limits. PHP-FPM: CVE-2026-109619's session upload progress path was validated as RCE on a normal dynamic pool; for CVE-2026-109618 FPM is judged susceptible by source analysis but no complete exploit has been shown. FrankenPHP and LiteSpeed (LSAPI) are susceptible by source analysis only.
    • AWS suggests looking for multipart POST requests containing the PHP_SESSION_UPLOAD_PROGRESS field. Exploitation need not leave a web shell on disk.

    Remediation

    • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every PHP worker. PHP says updating is the only complete fix. Rebuild and redeploy images, and verify the version that actually serves requests (CLI php -v may differ from PHP-FPM or mod_php). For distribution packages follow the distribution advisory, since backports may not change the upstream version.
    • Interim mitigations, set administratively: for CVE-2026-109618, memory_limit=-1, a conservative post_max_size with request size enforced at the frontend, lower max_input_nesting_level, bounded input variables, multipart parts and uploads, and blocking multipart at the frontend if unused; do not use RLIMIT_AS or RLIMIT_DATA. For CVE-2026-109619, session.upload_progress.enabled=0, fatal_error_backtraces=0 on PHP 8.5, and optionally pm.max_requests=1.
    • PHP 7.4, 8.0 and 8.1 have no upstream release, only minimal source backports; PHP 5.4 to 7.3 is end of life, so migrate or obtain a vendor backport.
    • Review activity from at least 17 October 2026 for new or modified PHP files, web shells, unexpected admin users, unusual outbound connections and unexpected child processes or shell commands launched by PHP or the web server.
11. infosecurity-magazine.com ↗ · pub. 22/10/2026 07:10 · coletado 22/10 08:01

    PHP2Shell: Exploitation Attempt Seen Four Days Before Disclosure, Mass Exploitation Follows Patches for CVE-2026-109618/109619

    Adds Cloudflare CEO Matthew Prince's exploitation volumes (thousands in the 10 hours before disclosure, millions now), Beelzebub as another firm observing attempts, the Dutch NCSC, French public administrations and University of Vienna taking sites offline, the W3Techs figure of 69.7%, and the mitigation list. It also says no official fixes exist for PHP 8.1 and earlier, which conflicts with the earlier reports of minimal source backports for 7.4, 8.0 and 8.1.

    ler a análise desta fonte ocultar

    Adds Cloudflare CEO Matthew Prince's exploitation volumes (thousands in the 10 hours before disclosure, millions now), Beelzebub as another firm observing attempts, the Dutch NCSC, French public administrations and University of Vienna taking sites offline, the W3Techs figure of 69.7%, and the mitigation list. It also says no official fixes exist for PHP 8.1 and earlier, which conflicts with the earlier reports of minimal source backports for 7.4, 8.0 and 8.1.

    Amazon Threat Intelligence confirmed that its MadPot honeypot logged an exploitation attempt against the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, on October 17. That is four days before the scheduled October 21 disclosure. The two critical flaws allow unauthenticated remote code execution (RCE) on sites running any PHP version back to 5.4. The attempt came from an IP address tied to a commercial anonymization network, which Amazon takes as a sign of a threat actor. How the actor obtained exploit details is unknown. Amazon now says the flaws are being broadly exploited, and Cloudflare CEO Matthew Prince reports attempts rising from thousands to millions. Other firms report attempts too, but successful compromise is still unconfirmed.

    Technical Details

    • PHP is used by about 69.7% of websites with a known server-side language (W3Techs). That includes CMS platforms such as WordPress, Drupal, Joomla and Magento.
    • The bugs were found in August by Calif and Wiz, with OpenAI's Patch the Planet project. Disclosure and patches were planned for October 21. On October 20 a pseudonymous Hacker News user leaked details early.
    • After the leak, French public administrations, the Dutch National Cyber Security Centre and the University of Vienna took sites offline to prepare for patching.
    • Amazon saw several PoC exploits around 02:00 GMT on October 21, about 12 hours before the 14:00 GMT disclosure. Further attempts hit MadPot sensors between 02:00 and 08:00 GMT from other infrastructure. Varying payloads and anonymization infrastructure suggest multiple actors. It is unclear whether the attempts would have worked against real systems.
    • More PoCs appeared within hours of the patches and were used against Amazon's sensors almost immediately.
    • Matthew Prince said Cloudflare saw thousands of attempts in the 10 hours before disclosure, tens of thousands within 45 minutes after, hundreds of thousands within two hours, and millions since.
    • Beelzebub, Ellio, Recorded Future, VulnCheck, watchTowr and Wiz also observed exploitation attempts. Independent researchers have published PoCs that attackers can reuse.

    Remediation

    • Apply the fixed releases PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. PHP says updating is the only complete fix.
    • The article says official patches exist only for supported branches (8.2 and later). It advises PHP 8.1 and earlier, including PHP 7 and 5, to migrate urgently.
    • Interim measures that do not replace patching:
      • disable the vulnerable functionality where applicable;
      • restart PHP workers after configuration changes;
      • restrict unnecessary multipart/form-data requests;
      • enforce limits on request body size, multipart sections and headers;
      • keep resource limits in place to prevent memory exhaustion.
    • Cloudflare says free and paid WAF customers are protected by default. Organizations should still verify their own controls.
12. securityweek.com ↗ · pub. 22/10/2026 06:48 · coletado 22/10 08:00

    PHP2Shell RCE flaws probed four days before patches; mass exploitation attempts follow, over 1 million PHP servers unpatched

    SecurityWeek adds exposure estimates from Censys, VulnCheck and VirusTotal (over 1 million unpatched or EoL PHP hosts, about 920,000 in the US), a VulnCheck-observed failed webshell attempt from a Chinese IP, WatchTowr's assessment that no circulating PoC achieves RCE, JFrog's finding of fake PoCs and prank malware on GitHub, and expert comparisons to Log4Shell.

    ler a análise desta fonte ocultar

    SecurityWeek adds exposure estimates from Censys, VulnCheck and VirusTotal (over 1 million unpatched or EoL PHP hosts, about 920,000 in the US), a VulnCheck-observed failed webshell attempt from a Chinese IP, WatchTowr's assessment that no circulating PoC achieves RCE, JFrog's finding of fake PoCs and prank malware on GitHub, and expert comparisons to Log4Shell.

    Amazon reports that threat actors began probing for the critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) on October 17, four days before the October 21 patches and while the bugs were still under embargo. The activity came from a commercial anonymization network, and how the actor learned of the flaws is unknown. After the October 20 leak, PoC exploits spread quickly. Amazon, Cloudflare, Hadrian, Patchstack and WatchTowr observed mass exploitation attempts, but WatchTowr says none of the circulating PoCs achieve RCE. Censys, VulnCheck and VirusTotal estimate that more than 1 million internet-facing PHP hosts remain unpatched, many on end-of-life versions.

    Technical Details

    • Amazon saw the first exploitation on October 17 and multiple PoCs from additional anonymized infrastructure about 12 hours before public disclosure. Differences in payloads and origin suggest several actors.
    • Cloudflare CEO Matthew Prince reported thousands of attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within 2 hours, and millions since.
    • WatchTowr says the sprayed exploits either do not work, test for timing differences, or crash the target. JFrog has seen fake PoCs and prank malware on GitHub. VulnCheck says at least one Chinese IP unsuccessfully tried to deploy a webshell.
    • Exposure: Censys counted about 1.57 million unpatched hosts out of 1.58 million with identifiable versions. VulnCheck counted more than 2.6 million internet-facing PHP hosts, at least 1 million of them EoL. VirusTotal counted about 758,000 EoL hosts against roughly 272,000 on supported versions among 1.1 million that announce a version. About 920,000 hosts are in the US, concentrated on AWS, DigitalOcean, Alibaba, OVHcloud and Hetzner.
    • Forescout's Sai Molige and Expel's Marcus Hutchins compare the event to Log4Shell. Hutchins puts it about 50% of the way there, with worse direct exploitation but a shorter tail.

    Remediation

    • CISA urges updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
    • Investigate for signs of compromise.
    • Restrict what the web-facing PHP process can launch, access or connect to, as a backstop and not a substitute for patching.
    • Inventory forgotten and shadow PHP installations, since EoL versions will get no upstream fix.
13. thehackernews.com ↗ · pub. 22/10/2026 03:34 · coletado 22/10 08:00

    Amazon MadPot logged PHP2Shell exploit attempt 4 days before disclosure; broad exploitation followed patches

    The article adds vendor and agency telemetry and warnings: ELLIO's first request at 08:36 UTC on October 21, VulnCheck's honeypot IPs and the `php2shell-scan/109618` user-agent, Pantheon's 60,000+ blocked requests, CrowdStrike's note on near-absent traces, FBI, NSA and NCSC alerts, OpenAI's Codex check skill, CloudLinux fixed packages and VulnCheck exposure counts. It also states the affected scope as the 7.x and 8.x series, which differs from earlier reports of PHP 5.4 onward.

    ler a análise desta fonte ocultar

    The article adds vendor and agency telemetry and warnings: ELLIO's first request at 08:36 UTC on October 21, VulnCheck's honeypot IPs and the php2shell-scan/109618 user-agent, Pantheon's 60,000+ blocked requests, CrowdStrike's note on near-absent traces, FBI, NSA and NCSC alerts, OpenAI's Codex check skill, CloudLinux fixed packages and VulnCheck exposure counts. It also states the affected scope as the 7.x and 8.x series, which differs from earlier reports of PHP 5.4 onward.

    Amazon Threat Intelligence reported that its MadPot honeypot service logged an attempt to exploit the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) on October 17, 2026, four days before public disclosure. The attempt came from 103.216.220[.]92, an Australia-geolocated address tied to a commercial anonymization network. Amazon says it is unclear how the actor obtained exploit information while the flaws were under embargo. Both flaws are rated CVSS 9.2 and allow pre-authentication remote code execution in PHP core. Exploitation became broad after the patches shipped, with multiple actors and payloads observed from October 21. CISA, NCSC, the FBI and the NSA urged immediate patching or taking systems offline.

    Technical Details

    • The flaws were found by Calif, OpenAI and Wiz. The article says they affect every PHP release in the 7.x and 8.x series and put every reachable PHP endpoint at risk, including static forms, login routes and health checks.
    • CrowdStrike says exploitation leaves virtually no traces: workers stay stable, responses return HTTP 200, application logs show no anomalies, and the only server-side trace is a single memory-limit fatal in the web server error log.
    • Details and a PoC leaked before the planned October 22, 14:00 UTC disclosure, so the PHP Foundation moved the release up by a day. The Foundation says Chainguard broke the embargo by publishing fixed images.
    • Amazon saw multiple PoC exploits on release day, the earliest around 02:00 UTC on October 21, followed by attempts from anonymized infrastructure over six hours. The payload variety indicates multiple actors.
    • ELLIO saw the first PHP2Shell request against its sensors at 08:36 UTC on October 21, less than an hour after Chainguard published its images.
    • VulnCheck saw hosts 85.11.167[.]243 and 45.198.224[.]169 with user-agent php2shell-scan/109618 exploiting CVE-2026-109618 against its honeypots. 109.71.252[.]97 used both flaws.
    • Cloudflare sees attack traffic and attackers mutating payloads to evade its rules. Pantheon blocked over 60,000 suspicious requests.
    • Exposure: VulnCheck found PHP on 2,608,039 internet-facing hosts. Modat counted 4.38 million PHP services as of October 20, 79% on unsupported branches, with PHP 7.4 at 878,761 services.
    • Amazon's CISO CJ Moses says AI-assisted analysis shortens the time from patch to working exploit.

    Remediation

    • Apply the PHP fixes immediately, or take exposed servers offline. CloudLinux released fixed packages for ea-php52 through ea-php85 and all alt-php versions.
    • The FBI advises monitoring web servers for PHP processes launching command shells or downloading files, with process monitoring in place.
    • OpenAI released a Codex skill to check whether a website or local PHP binary is vulnerable.
    • Inventory PHP usage, assign remediation owners and plan for a long tail of bundled and legacy PHP installs.
14. gbhackers.com ↗ · pub. 22/10/2026 02:06 · coletado 22/10 04:00

    PHP2Shell: Amazon MadPot saw exploitation of CVE-2026-109618 and CVE-2026-109619 on Oct 17, four days before PHP patches

    Amazon's MadPot honeypots recorded the earliest known exploitation attempt on October 17, 2026, from 103.216.220.92, four days before disclosure and earlier than the exploitation reports in the case so far. Amazon also reports PoCs from about 02:00 UTC on October 21, multiple likely actors, no confirmed successful compromise, and advises upgrading as the only complete fix, investigating from October 17 and hunting for PHP_SESSION_UPLOAD_PROGRESS.

    ler a análise desta fonte ocultar

    Amazon's MadPot honeypots recorded the earliest known exploitation attempt on October 17, 2026, from 103.216.220.92, four days before disclosure and earlier than the exploitation reports in the case so far. Amazon also reports PoCs from about 02:00 UTC on October 21, multiple likely actors, no confirmed successful compromise, and advises upgrading as the only complete fix, investigating from October 17 and hunting for PHP_SESSION_UPLOAD_PROGRESS.

    Amazon's MadPot honeypot network recorded exploitation attempts against two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619 (collectively PHP2Shell), on October 17, 2026, four days before public disclosure and patches. The earliest attempt came from 103.216.220.92, an address tied to commercial anonymization infrastructure. Amazon assessed that targeting an embargoed vulnerability through anonymized infrastructure points to threat actor activity, but investigators have not established how the attacker obtained exploit information before disclosure. Both flaws carry CVSS v4.0 9.2 and enable unauthenticated remote code execution. Amazon later described PHP2Shell as broadly exploited in the wild.

    Technical Details

    • CVE-2026-109618: out-of-memory handling flaw. Memory exhaustion interrupts initialization of internal request data, and later cleanup treats the partially initialized data as valid, causing memory corruption that can lead to RCE.
    • CVE-2026-109619: stale global state and use-after-free. State retained from one request can reference freed memory and be used by a later request in the same worker. PHP also confirms memory disclosure as an impact.
    • The defects sit in PHP itself and affect PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php is considered the most exposed because exploitation can occur before application code runs, so application-level authentication does not help.
    • Proof-of-concept exploits appeared around 02:00 UTC on October 21, about 12 hours before the 14:00 UTC embargo lift. Between 02:00 and 08:00 UTC MadPot logged more attempts from anonymized infrastructure; differing payloads and infrastructure suggest multiple actors rather than one coordinated campaign.
    • Amazon says the observed attempts were not confirmed to have succeeded against real systems and that its technical analysis is ongoing. Its assessment links shrinking exploit-development windows to AI-assisted analysis but does not establish that AI produced the pre-disclosure attacks.

    Remediation

    • Upgrade to fixed releases PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; distribution users should check vendor advisories. Minimal source backports exist for unsupported PHP 7.4 through 8.1, but there is no official release.
    • Amazon states that upgrading is the only complete remediation; configuration changes cannot fully resolve the combined exposure. Temporarily blocking multipart file uploads may reduce exposure, after assessing application impact.
    • Start investigations no later than October 17. Examine POST requests containing PHP_SESSION_UPLOAD_PROGRESS in form data, review web server logs, and look for unexpected process execution or file modifications on application servers.
    • Amazon's indicators include shared anonymization infrastructure, so matches warrant investigation, not automatic attribution or indiscriminate blocking. Use behavior-based detections until vulnerability-specific signatures are available.
15. recordedfuture.com ↗ · pub. 20/10/2026 21:00 · coletado 21/10 22:00

    PHP2Shell: Critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 face exploitation attempts as PHP ships emergency fixes

    Recorded Future (Insikt Group) adds a detailed timeline: discovery on August 19, Wiz RCE confirmations on August 20 and 21, PHP acknowledgment on September 21, a leaked archive submitted to VirusTotal at 02:29 UTC on October 21, Patchstack's 07:34 UTC exploitation reports and a PHP release at 13:52 UTC. It also adds Wiz's per-CVE RCE demonstrations, the J4ck3LSyN PoCs that were later invalidated, Modat and VirusTotal exposure data (including 85,000 IPs on the vulnerable September 24 releases and SSH/MySQL/RDP co-exposure) and a recommendation to extend hunting back to October 20.

    ler a análise desta fonte ocultar

    Recorded Future (Insikt Group) adds a detailed timeline: discovery on August 19, Wiz RCE confirmations on August 20 and 21, PHP acknowledgment on September 21, a leaked archive submitted to VirusTotal at 02:29 UTC on October 21, Patchstack's 07:34 UTC exploitation reports and a PHP release at 13:52 UTC. It also adds Wiz's per-CVE RCE demonstrations, the J4ck3LSyN PoCs that were later invalidated, Modat and VirusTotal exposure data (including 85,000 IPs on the vulnerable September 24 releases and SSH/MySQL/RDP co-exposure) and a recommendation to extend hunting back to October 20.

    Recorded Future's Insikt Group reports that two critical remote code execution flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (nicknamed PHP2Shell), are being targeted in reported exploitation attempts after technical details leaked ahead of PHP's coordinated release. Both are rated CVSS v4.0 9.2. PHP shipped fixes on October 21, 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Wiz Research, working with Calif and OpenAI, found the flaws and demonstrated unauthenticated RCE against WordPress, Drupal and Joomla. Patchstack (via hosting partners) and Cloudflare's CTO reported early attacks, but Insikt says public evidence does not establish the extent of successful compromise. Exposure is large: VirusTotal counts about 5.1 million PHP IP addresses and Modat about 4.4 million PHP services, most on end-of-life branches.

    Technical Details

    • CVE-2026-109618: an OOM-related flaw involving partially initialized request memory. Wiz identified a use-after-free (UAF) in the session upload-progress unserializer and a related memory disclosure of PHP worker memory. Unauthenticated RCE was demonstrated against WordPress, Drupal and Joomla.
    • CVE-2026-109619: a stale-state flaw in which PHP globals keep references to freed request memory. It includes a UAF involving fatal-error backtraces and a separate OPcache type-confusion flaw. Unauthenticated RCE was demonstrated against Drupal and WordPress.
    • The flaws sit in the PHP runtime, not in application code, so secure applications can still be exposed. Session upload-progress has existed since PHP 5.4.0 and is enabled by default (VirusTotal).
    • Timeline: Wiz found the first flaw on August 19, 2026 and reported to PHP on August 24. PHP acknowledged the reports on September 21 and announced the out-of-band release on October 20. A leaked archive was first submitted to VirusTotal at 02:29 UTC on October 21. Patchstack reported exploitation incidents at 07:34 UTC. PHP released fixes at 13:52 UTC, ahead of the 14:00 UTC schedule.
    • Public PoCs: researcher J4ck3LSyN published poc0_109618.py and poc1_109619.py, then invalidated the cached-pointer UAF theory behind them. Insikt has not independently tested any public PoC, and some repositories rely on invalidated theories.
    • Exposure: VirusTotal sees about 5.1M PHP IPs, of which about 1.1M disclose a version. About 758,000 of those run an end-of-life branch (5.4 to 8.1) against about 272,000 on supported branches. Modat sees 4,384,302 PHP services on 1,886,612 hosts, about 79% of versioned services on unsupported branches, and PHP 7.4 accounts for 878,761. About 85,000 IPs ran the September 24 releases, which were vulnerable.
    • VirusTotal also found about 394,000 PHP hosts exposing SSH, about 233,000 exposing MySQL and about 68,000 exposing RDP. Memory disclosure can leak passwords, tokens, API keys and certificates, and application logs may show little.

    Remediation

    • Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, prioritizing internet-facing systems. Include PHP embedded in third-party applications, containers and managed services. Migrate unsupported branches or obtain vendor-maintained fixes.
    • Inventory PHP deployments, and use WAF rules, request filtering, PHP hardening and restricted access as stopgaps only. Make sure origin servers cannot be reached directly.
    • Hunt back to at least October 20, 2026 for anomalous HTTP requests, PHP process failures and unexpected command execution. Rotate potentially exposed credentials and start incident response where compromise is found.
16. theregister.com ↗ · pub. 21/10/2026 20:02 · coletado 21/10 22:00

    PHP2shell: Critical PHP RCE flaws CVE-2026-109618/109619 exploited after Chainguard breaks disclosure embargo

    ler a análise desta fonte ocultar

    PHP maintainers released emergency patches for two critical memory corruption flaws, collectively called PHP2shell (CVE-2026-109618 and CVE-2026-109619), that allow unauthenticated remote code execution. The PHP Foundation accuses Chainguard of breaking the coordinated disclosure embargo on 21 October at 07:41 UTC, more than six hours before the planned release, by publishing built images containing the fix. Chainguard CEO Dan Lorenc does not dispute the timeline. He says rumors, public PoCs and reports of in-the-wild exploitation by other vendors justified shipping early. The bugs were found by researchers at Calif, OpenAI and Wiz using AI models, and Chainguard says it independently found the same flaws with a frontier model. Chainguard honeypots reportedly trapped IPs from China and Russia targeting the flaws on Wednesday, and the full scope of exploitation is unknown.

    Technical Details

    • CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory corruption. If a request hits memory_limit at the wrong moment, PHP leaves partially initialized internal data behind and later treats it as valid. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs.
    • CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): stale state. A fatal error at the wrong point leaves internal state pointing to memory from a previous request, so a later request on the same worker can use freed memory. A use-after-free and worker crash were confirmed, and RCE was demonstrated against a real-world application on Apache with mod_php.
    • Wiz says every PHP version released in the last decade is affected by at least one of the flaws, going back to 5.4. Both are exploitable remotely, in some cases fairly easily.
    • Leak chronology: on 20 October at about 15:00 UTC the CVE IDs began circulating with incorrect release time and CVSS data, so disclosure was moved from Thursday to Wednesday. Hours later Calif mistakenly published a PoC video with limited details. Mitigation advice given to a few critical infrastructure providers from about 20 October 23:00 UTC may also have leaked.
    • Possible impact per Wiz: server takeover, data theft and website defacement.

    Remediation

    • Patch PHP immediately using the emergency releases or distributor packages. Wiz strongly advises immediate patching.
    • Legacy PHP versions without security fixes remain exposed, so prioritize upgrading or isolating them.
    • Review internet-facing PHP servers, especially Apache with mod_php, for signs of exploitation.
17. sec.cloudapps.cisco.com ↗ · pub. 21/10/2026 16:12 · coletado 21/10 18:00 só resumo do feed

    PHP Foundation patches two critical RCE flaws (PHP2shell), CVE-2026-109618 and CVE-2026-109619; Cisco assesses product impact

    ler a análise desta fonte ocultar

    On October 21, the PHP Foundation released a Critical PHP Security release fixing two critical remote code execution vulnerabilities, collectively referred to as PHP2shell. Cisco published an advisory on how these flaws affect its products and rated the security impact Critical. The excerpt does not list which Cisco products are affected, and it does not mention exploitation in the wild.

    Technical Details

    • CVE-2026-109618: RCE via OOM (out-of-memory) corruption.
    • CVE-2026-109619: RCE via stale global state.
    • Upstream advisories: GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
    • Cisco advisory ID: cisco-sa-php-october26-Jj384Daq.

    Remediation

    Apply the PHP Critical Security release from the PHP Foundation. Check the Cisco advisory for the list of affected Cisco products and fixed software releases.

18. sentinelone.com ↗ · pub. 21/10/2026 16:21 · coletado 21/10 18:00

    PHP2Shell: critical unauthenticated RCE and memory-disclosure flaws CVE-2026-109618 and CVE-2026-109619 patched in PHP core

    SentinelOne adds the disclosure timeline (Calif and OpenAI reported the root cause on August 11, 2026 and Wiz reported additional vectors on August 24; the 2024 audit was by OSTIF and Quarkslab), CWE-416/CWE-755 classification, a Talos estimate that about half of internet-facing PHP runs on unpatched end-of-life branches, Cloudflare's observation of payload mutation to bypass WAF rules, the PHPSESSID-cookie memory disclosure channel, extra hardening steps (pm.max_requests, SELinux/AppArmor, avoiding RLIMIT_AS/RLIMIT_DATA, fatal_error_backtraces=0 on PHP 8.5), and its own detection and hunting guidance.

    ler a análise desta fonte ocultar

    SentinelOne adds the disclosure timeline (Calif and OpenAI reported the root cause on August 11, 2026 and Wiz reported additional vectors on August 24; the 2024 audit was by OSTIF and Quarkslab), CWE-416/CWE-755 classification, a Talos estimate that about half of internet-facing PHP runs on unpatched end-of-life branches, Cloudflare's observation of payload mutation to bypass WAF rules, the PHPSESSID-cookie memory disclosure channel, extra hardening steps (pm.max_requests, SELinux/AppArmor, avoiding RLIMIT_AS/RLIMIT_DATA, fatal_error_backtraces=0 on PHP 8.5), and its own detection and hunting guidance.

    The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026 to fix two critical core flaws, CVE-2026-109618 and CVE-2026-109619, collectively named PHP2Shell (CVSS v4.0 9.2 each). An unauthenticated attacker can send a single crafted HTTP request to achieve remote code execution as the web worker or to read process memory containing passwords, tokens and API keys. The bugs were found through AI-assisted auditing by Calif, Wiz and OpenAI, and trace back to an out-of-memory weakness flagged but not proven exploitable in a 2024 audit. SentinelOne reports that Cloudflare observed attack attempts after the CVE IDs leaked on October 20, with no verified public proof-of-concept and no confirmed in-the-wild compromise as of publication.

    Technical Details

    • Root cause: on a fatal condition such as exhausting the memory limit, PHP exits via longjmp without cleanup, leaving half-built state that a later cleanup routine or request trusts (CWE-416, CWE-755).
    • CVE-2026-109618 (out-of-memory case): request data is marked valid before allocation. If allocation fails, the entry points to uninitialized heap memory that is processed at cleanup. On Apache with mod_php this runs before any application code.
    • CVE-2026-109619 (stale-state case): after a fatal error a global pointer references freed memory, and a later request on the same worker triggers a use-after-free. Session upload progress (enabled by default) is a confirmed trigger.
    • Affected: PHP from 5.4.0 up to each branch's fixed release. PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed are all at risk, with mod_php highest. Every CMS and framework (WordPress, Drupal, Joomla, Magento, Laravel) is exposed through the runtime.
    • Attack chain: a crafted multipart request (chunked or lengthless, empty file fields with deeply nested names) forces large allocations or a fatal error. Heap grooming then yields code execution as the worker (commonly www-data), or a separate path leaks worker memory through the PHPSESSID response cookie with no code execution.
    • Post-exploitation: webshell drop in the web root, spawned sh/bash/python/curl/wget, outbound connections, and lateral movement with recovered credentials.
    • Talos estimates about half of internet-facing PHP runs on branches with no official update. Cloudflare saw attackers mutating payloads to bypass its WAF rules.
    • Detection: web workers (php-fpm, php-cgi, httpd, apache2, w3wp) spawning shells or downloaders, new script files in web roots, unusual multipart requests followed by memory-limit fatals or HTTP 500s, and oversized or malformed PHPSESSID cookies. The memory-disclosure path leaves no process behavior and is visible only in web server, WAF and CDN logs.

    Remediation

    • Update every PHP runtime to a fixed version and restart Apache, PHP-FPM and all long-running workers. Check the version the web server actually loads, and confirm packaged builds against the vendor advisory.
    • Inventory internet-facing PHP, including copies bundled in appliances, cPanel, Plesk and vendor software.
    • Isolate end-of-life PHP (8.1 and older) behind a VPN or take it off the internet. Source-only backports exist for 7.4, 8.0 and 8.1.
    • Rotate credentials, tokens, keys and certificates reachable by workers on exposed, unpatched systems.
    • Interim and partial only: memory_limit=-1 with a low post_max_size, session.upload_progress.enabled=0, fatal_error_backtraces=0 on PHP 8.5, lower pm.max_requests, cgroup memory.max, SELinux/AppArmor, and WAF or proxy limits on multipart size, count and nesting depth. Do not use RLIMIT_AS or RLIMIT_DATA.
    • Hunt for new web shells, cron jobs and accounts, and monitor the PHP changelog.
19. security.paloaltonetworks.com ↗ · pub. 21/10/2026 13:00 · coletado 21/10 14:02

    Palo Alto Networks: PAN-OS and Panorama affected by critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619; fix pending

    Palo Alto Networks has confirmed that all PAN-OS and Panorama versions are affected. It rates the issue HIGH (CVSS-B 8.7 with internet-exposed management interface), has no fixed releases yet, and reports no known exploitation against its products. It has published interim mitigations: Threat ID 543004 for Frontier Virtual Patching customers and IPS signatures 543004 and 97622-97625 from Oct 21, plus management interface access restrictions.

    ler a análise desta fonte ocultar

    Palo Alto Networks has confirmed that all PAN-OS and Panorama versions are affected. It rates the issue HIGH (CVSS-B 8.7 with internet-exposed management interface), has no fixed releases yet, and reports no known exploitation against its products. It has published interim mitigations: Threat ID 543004 for Frontier Virtual Patching customers and IPS signatures 543004 and 97622-97625 from Oct 21, plus management interface access restrictions.

    Palo Alto Networks published a PSIRT advisory on the impact of two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on its products. All versions of PAN-OS and Panorama are listed as vulnerable, and no special configuration is required to be affected. The vendor rates the issue HIGH with suggested urgency MODERATE and is not aware of any malicious exploitation against its products. Fixed PAN-OS releases have not yet been published and will be added to the advisory later. Interim protection relies on Threat Prevention signatures and on restricting management interface access.

    Technical Details

    • CVE-2026-109618: handling of out-of-memory errors via longjmp() leaves request memory uninitialized because of improper control flow, which allows reliable RCE through OOM triggers.
    • CVE-2026-109619: longjmp() fatal error handling leaves global memory pointing to freed regions, which can be read or branched on in later requests and lead to arbitrary code execution.
    • Weakness and pattern: CWE-754 and CAPEC-153.
    • Risk is highest on PAN-OS when the management interface is reachable from external internet IPs. The vendor's CVSS-B score is 8.7 for that exposure and 7.1 when access is limited to a jump box.
    • The advisory also cites a separate CVSS-B of 9.2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) against a "Vendor" label, which appears to be the base score for the underlying PHP flaws.

    Remediation

    • Restrict management interface access to trusted internal IP addresses only, ideally through a single jump box, in line with vendor best practice.
    • Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage via Threat ID 543004, released on Oct 20.
    • Advanced Threat Prevention will release standard IPS coverage (signatures 543004, 97622, 97623, 97624, 97625) on Oct 21.
    • Apply the PAN-OS fixed releases once published, and monitor the advisory for updates. Unit 42 has further details on product protections.
20. cisa.gov ↗ · pub. 21/10/2026 09:00 · coletado 21/10 14:02

    CISA urges immediate patching of critical unauthenticated PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 (php2shell)

    This is the CISA government advisory on php2shell. It adds that CISA had not observed exploitation as of publication, names the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), and recommends taking unpatched or unsupported (8.1 and earlier) PHP systems offline. It also advises monitoring for PHP worker processes launching shells or downloading tools.

    ler a análise desta fonte ocultar

    This is the CISA government advisory on php2shell. It adds that CISA had not observed exploitation as of publication, names the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), and recommends taking unpatched or unsupported (8.1 and earlier) PHP systems offline. It also advises monitoring for PHP worker processes launching shells or downloading tools.

    CISA issued an alert urging organizations to immediately patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as php2shell. The flaws allow unauthenticated remote code execution and affect all PHP installations serving web requests. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA states it has not observed exploitation as of publication but stresses the risk to unpatched systems.

    Technical Details

    • The vulnerabilities permit unauthenticated remote code execution in PHP; the advisory gives no root-cause detail.
    • PHP is often embedded in other software, so its presence may not be directly observable.
    • Suggested detection focus: PHP worker processes launching shells or downloading tools.

    Remediation

    • Identify and inventory all systems running any version of PHP, including PHP bundled in other software.
    • Apply the patches immediately, prioritizing internet-facing systems.
    • Take PHP-based systems offline until patched if they cannot be updated immediately, or if they run unsupported versions (PHP 8.1 or earlier).
    • A web application firewall may provide some interim protection.
    • Review the official PHP security advisory and monitor for suspicious activity such as PHP workers spawning shells or downloading tools.
21. securelist.com ↗ · pub. 21/10/2026 12:18 · coletado 21/10 14:00

    PHP2Shell: Kaspersky details detections for critical unauthenticated PHP RCE flaws CVE-2026-109618 and CVE-2026-109619

    This Kaspersky write-up adds vendor detection coverage (KEDR rules, KATA network verdicts and Behavior Detection PDM signatures), Sansec's estimate that mass exploitation could begin within 15 minutes of the patch release, and a technical characterization of the flaws as use-after-free and memory corruption tied to multipart/form-data handling and session.upload_progress. It also lists interim mitigations: disabling session.upload_progress in PHP-FPM pools and blocking multipart requests on nginx and Apache.

    ler a análise desta fonte ocultar

    This Kaspersky write-up adds vendor detection coverage (KEDR rules, KATA network verdicts and Behavior Detection PDM signatures), Sansec's estimate that mass exploitation could begin within 15 minutes of the patch release, and a technical characterization of the flaws as use-after-free and memory corruption tied to multipart/form-data handling and session.upload_progress. It also lists interim mitigations: disabling session.upload_progress in PHP-FPM pools and blocking multipart requests on nginx and Apache.

    On October 20, 2026 the PHP security team announced an emergency release for two critical flaws, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), and patches shipped on October 21 at 14:00 UTC. The release was moved up after details leaked on Hacker News ahead of the embargo, together with an exploit unofficially named PHP2Shell. A leaked demo video shows the exploit running against servers hosting WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS, though its authenticity and exact behavior were not independently verified. The flaws allow unauthenticated remote code execution as the PHP process and reportedly affect all versions from PHP 5.4.0. Sansec estimates mass exploitation could start within 15 minutes of the patch release. Kaspersky published guidance and detection coverage for the activity.

    Technical Details

    • According to the PoC author, the bugs involve handling of the multipart/form-data MIME type together with the session upload progress mechanism (session.upload_progress) in the PHP core, and fall into use-after-free and memory corruption classes. They cannot be fixed in application code; only a PHP update resolves them.
    • Versions 5, 6, 7 and 8 are affected. Supported branches are 8.2 to 8.5. Branches 8.1, 8.0, 7.x and 5.x are end-of-life, but backported patches were released for 7.4, 8.0 and 8.1.
    • Kaspersky Endpoint Detection and Response rules: creating_windows_shell_from_a_web_servers_process, possible_web_shell_creating_via_exploit, spawning_process_from_webserver_more_filters_linux, webserver_interpreter_execution_linux, executable_file_in_www_folder.
    • Kaspersky Anti Targeted Attack (KATA) network verdicts: Exploit.CVE-2026-109618.HTTP.C&C and Exploit.CVE-2026-109619.HTTP.C&C.
    • Kaspersky Endpoint Security / Kaspersky Next Behavior Detection: PDM:Exploit.Linux.Generic and PDM:Exploit.Win32.Generic.

    Remediation

    • Inventory all PHP-based systems, including web servers, control panels and third-party software.
    • Apply the PHP patches immediately. Migrate servers on unsupported branches (8.1 and earlier) to a current PHP branch.
    • As interim mitigation, set session.upload_progress.enabled = Off via php_admin_flag in PHP-FPM pools, and block multipart requests on nginx and Apache.
    • Consider temporarily isolating internet-facing PHP applications until patched.
22. krebsonsecurity.com ↗ · pub. 21/10/2026 12:26 · coletado 21/10 14:00

    Critical PHP zero-days CVE-2026-109618 and CVE-2026-109619 enable RCE and are exploited in the wild, affecting PHP 5.4 and later

    ler a análise desta fonte ocultar

    PHP released an emergency update for two critical zero-day vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They allow remote code execution, denial of service and data exposure, and are reportedly already being exploited in the wild. Nearly 70 percent of websites are said to need updating, and Reuters reports that government websites in Europe and elsewhere went offline after disclosure. Wiz says every PHP version released in the last decade is affected by at least one of the flaws and compares the situation to Log4Shell. The flaws were found with help from frontier AI models and were disclosed in coordination with Wiz, Calif, OpenAI and the PHP team.

    Technical Details

    • Affected: all web servers running PHP 5.4 or later, which includes platforms such as Drupal, Magento, Joomla and WordPress.
    • Wiz notes that the underlying flaws had existed for decades, but exploiting them required an exceptionally complex chain of steps that AI models made feasible.
    • Wiz expects mass exploitation to install web shells for remote control of compromised sites.
    • Cloudflare has detected some exploitation and deployed WAF rules at 03:02 UTC.
    • Ubuntu has already released updated PHP packages, and the SANS Internet Storm Center is tracking vendor updates.

    Remediation

    • Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as possible.
    • Apply vendor and distribution patches (for example, Ubuntu packages).
    • Enable WAF protections such as the Cloudflare rules while patching is in progress.
    • Hunt for web shells and signs of compromise on exposed PHP servers.
23. securityweek.com ↗ · pub. 21/10/2026 13:50 · coletado 21/10 14:00

    PHP2Shell: PHP patches critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619 as in-the-wild exploitation attempts begin

    Adds the first confirmed in-the-wild exploitation reports: watchTowr saw attempts at patch time with no success, and Hadrian reported at-scale exploitation, mostly via PHP's session upload-progress path. Patchstack, Cloudflare and Vega also saw attempts, and Vega's used a public PoC. It also details discovery by Wiz, OpenAI and Calif using frontier AI (reported August 11), and says the flaws group four memory-safety issues with likely untracked variants. It reports further leaks: a PoC video published early, and Chainguard fixed images released six hours before the coordinated release. It notes that 15 PHP CVEs have been published since July 1.

    ler a análise desta fonte ocultar

    Adds the first confirmed in-the-wild exploitation reports: watchTowr saw attempts at patch time with no success, and Hadrian reported at-scale exploitation, mostly via PHP's session upload-progress path. Patchstack, Cloudflare and Vega also saw attempts, and Vega's used a public PoC. It also details discovery by Wiz, OpenAI and Calif using frontier AI (reported August 11), and says the flaws group four memory-safety issues with likely untracked variants. It reports further leaks: a PoC video published early, and Chainguard fixed images released six hours before the coordinated release. It notes that 15 PHP CVEs have been published since July 1.

    PHP released patches on October 21, 2026 for two critical flaws dubbed PHP2Shell, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state). Both are rated CVSS 9.2 and allow unauthenticated remote code execution, confirmed on Apache with mod_php. watchTowr saw the first in-the-wild exploitation attempts around the time the patches landed, but no successful attempts. Hadrian reported exploitation "at scale" a few hours before the fixes shipped, mostly abusing PHP's session upload-progress path. Patchstack, Cloudflare and Vega also observed attempts, and Vega's leveraged a public PoC. The flaws affect nearly all PHP releases back to 5.4, and the PHP Foundation says every PHP installation that handles web requests is potentially at risk. The flaws can also be used to read sensitive process memory, which may hold credentials and API keys.

    Technical Details

    • Both flaws sit in core PHP, in memory management and error handling, so they are independent of the CMS. The article says they affect about 70% of websites, including WordPress, Drupal and MediaWiki.
    • Affected runtimes: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
    • Wiz says the two CVEs group four memory-safety issues but do not cover all variants. Both tracked and likely untracked variants exist.
    • Wiz, OpenAI and Calif found the flaws in August using frontier AI models. Calif and OpenAI independently reported the OOM-to-RCE chain on August 11, and OpenAI and Wiz later reported additional vectors. An OOM flaw was first found in 2020 and again in a 2024 audit, but was not patched because exploitation was unproven.
    • The planned disclosure date was October 22. Information leaked online on October 20, so the PHP Foundation moved the release up by a day.
    • A video showing a working PoC was published early and accelerated the development of PoCs.
    • Chainguard published images containing the fix six hours before the coordinated release, which let attackers study the fix in binary form.
    • Cloudflare deployed protections nine hours before public disclosure.
    • Since July 1, 15 new PHP CVEs have been published, which the PHP Foundation attributes to AI-assisted discovery.

    Remediation

    • Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Minimal source backports exist for PHP 7.4, 8.0 and 8.1.
    • Where patching is not possible, interim measures reduce exposure to specific attack paths but do not make an installation safe.
    • Inventory where PHP runs, and pre-authorize who can approve urgent changes.
    • Verify that the update took effect.
    • Check whether systems were compromised before the fix was applied, and rotate credentials and API keys that may have been exposed from process memory.
24. thehackernews.com ↗ · pub. 21/10/2026 11:00 · coletado 21/10 14:00

    PHP patches two critical unauthenticated RCE flaws (PHP2Shell, CVE-2026-109618/109619) as early exploit attempts emerge

    Adds technical and operational detail beyond the known case: mod_php is the highest-risk SAPI with a single-request pre-application exploit, and the FPM exposure differs per CVE. It also gives per-CVE interim mitigations, noting that disabling session upload progress was never a complete fix. Further additions are detection guidance (multipart requests with memory-limit errors or HTTP 500s, oversized PHPSESSID cookies, worker restarts), BambooHR's precautionary outage, and the researchers' statement that AI helped weaponize the decade-old flaws. It also confirms that no successful exploitation had been reported and that neither CVE was in CISA KEV at the time.

    ler a análise desta fonte ocultar

    Adds technical and operational detail beyond the known case: mod_php is the highest-risk SAPI with a single-request pre-application exploit, and the FPM exposure differs per CVE. It also gives per-CVE interim mitigations, noting that disabling session upload progress was never a complete fix. Further additions are detection guidance (multipart requests with memory-limit errors or HTTP 500s, oversized PHPSESSID cookies, worker restarts), BambooHR's precautionary outage, and the researchers' statement that AI helped weaponize the decade-old flaws. It also confirms that no successful exploitation had been reported and that neither CVE was in CISA KEV at the time.

    The PHP project released emergency updates on October 21, 2026 for two critical flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. They allow unauthenticated code execution on web servers and are rated CVSS v4.0 9.2. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws were found by Wiz Research, Calif and OpenAI's Codex Security team and affect nearly every PHP version back to 5.4. The release was pulled forward a day after details leaked. Cloudflare reported early exploit attempts before the patch shipped. No source has confirmed a successful break-in, and neither CVE was in CISA's KEV catalog at the time of reporting.

    Technical Details

    • The flaws sit in the PHP engine, not in application code, so even a minimal "Hello World" page on a vulnerable version is exposed. Affected SAPIs include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
    • mod_php is the highest risk: a demonstrated exploit triggers with a single unauthenticated request before any application code runs.
    • PHP-FPM behaves differently because it shuts the worker down when a request fails early in setup. For CVE-2026-109618, FPM is judged susceptible but no complete FPM exploit has been shown. CVE-2026-109619 was shown to reach code execution on both mod_php and PHP-FPM, though the FPM path depends on an operation inside the running application.
    • An attacker can also read live memory from the PHP worker process, which may hold passwords, tokens, API keys and certificates from other requests, without first gaining code execution.
    • Session upload progress is on by default and takes part in one confirmed attack path for CVE-2026-109619. Disabling it does nothing for CVE-2026-109618.
    • The researchers say AI models helped turn these decade-old flaws into working exploits, letting one researcher do in about a week what would otherwise take a team months. Calif traced the bug lineage to PHP research from 2004.
    • Precautionary outages: BambooHR took its service offline in the US, Canada and Ireland. In the Netherlands, MijnOverheid, DigiD, the lower house's site, the national cyber-security center and several education systems went offline, per NOS.

    Remediation

    • Update the PHP runtime that serves web requests, then restart Apache, PHP-FPM and any long-running PHP workers. Updating WordPress or Laravel does not update the underlying runtime, which comes from the server package, host or container image.
    • Distribution packages may carry the fix under an old-looking version, so check the package changelog for the CVE rather than the version string.
    • PHP published source backports for PHP 7.4, 8.0 and 8.1. PHP 8.2 reaches end of life on December 31, 2026.
    • Interim mitigations only reduce exposure. For CVE-2026-109618, set memory_limit=-1, keep post_max_size low and enforce request-size limits at the web server or proxy. Do not use RLIMIT_AS or RLIMIT_DATA. For CVE-2026-109619, set session.upload_progress.enabled=0 and restart workers, and on PHP 8.5 also set fatal_error_backtraces=0.
    • After patching, review memory_limit and post_max_size, because the new hard memory limit ends the process and skips shutdown handlers.
    • Hunt for unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, oddly large PHPSESSID response cookies, and unexplained PHP worker restarts.
25. wired.com ↗ · pub. 21/10/2026 11:26 · coletado 21/10 12:01

    PHP Foundation patches critical CVE-2026-109618 and CVE-2026-109619 as early attacks emerge and government sites go offline

    The patches have now been released (just before 10 am ET on October 21). Cloudflare reports early attacks emerging before release. Government and port websites in Finland, France and the Netherlands (Port of Rotterdam) were taken offline as a precaution. Wiz describes impact as unauthenticated code execution or process memory disclosure, and says it found the flaws partly with AI. OpenAI and Calif claim independent discovery. NCSC and FBI published response guidance.

    ler a análise desta fonte ocultar

    The patches have now been released (just before 10 am ET on October 21). Cloudflare reports early attacks emerging before release. Government and port websites in Finland, France and the Netherlands (Port of Rotterdam) were taken offline as a precaution. Wiz describes impact as unauthenticated code execution or process memory disclosure, and says it found the flaws partly with AI. OpenAI and Calif claim independent discovery. NCSC and FBI published response guidance.

    The PHP Foundation released fixes just before 10 am ET on October 21 for two critical flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 each). The flaws affect all PHP installations serving web requests, going back to PHP 5. Cloudflare reported "early attacks emerging" before the patches were published, and Sansec expected mass exploitation within 15 minutes of release. Ahead of the release, some organizations took sites offline as a precaution, including multiple Finnish government sites (the National Land Survey), French government sites and the Port of Rotterdam. Wiz says it found the flaws partly with AI tools, while OpenAI and Calif claim independent discovery. Only PHP 8.2 and newer receive patches, and the PHP Foundation states there are no complete mitigations.

    Technical Details

    • Per Wiz, unauthenticated attackers can execute code on affected servers or read sensitive process memory (passwords, tokens, API keys, certificates). Wiz calls its demonstration php2shell and says exploitation can be "fairly easy" in some cases.
    • Consultant Davi Ottenheimer describes the bug as sitting in a file upload interface, where a single crafted upload to any reachable server is the entire attack.
    • Experts warn of potential wormable malware. Details reportedly leaked before the official publication (BleepingComputer, Ars Technica).
    • Software built on PHP, such as WordPress, Drupal and Magento, is exposed. Legacy PHP versions remain unpatched unless a distribution or vendor backports fixes.

    Remediation

    • Update PHP immediately. The PHP Foundation says updating is the only safe choice.
    • The NCSC advises identifying all PHP systems, prioritizing internet-facing ones, monitoring them for exploitation, and watching for vendor updates to software that embeds PHP. Where immediate patching is not feasible, consider taking the system offline.
    • The FBI (Brett Leatherman) advises isolating compromised systems, preserving web server and PHP logs, and reporting to the local FBI field office.
26. elastic.co ↗ · pub. 20/10/2026 21:00 · coletado 21/10 12:01

    php2shell: Elastic detection coverage for PHP core RCE flaws CVE-2026-109618 and CVE-2026-109619 after pre-disclosure leak

    Elastic Security Labs adds the PHP security team's published root causes (OOM corruption and stale global state), the fixed versions (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35), the fix commit, the only partial php.ini mitigations, and the fact that watchTowr reproduced CVE-2026-109618 without observing in-the-wild exploitation. It also adds a behavioral detection strategy with named Elastic EDR and SIEM rules and PHP inventory queries, plus additional ATT&CK mappings (T1059, T1505.003).

    ler a análise desta fonte ocultar

    Elastic Security Labs adds the PHP security team's published root causes (OOM corruption and stale global state), the fixed versions (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35), the fix commit, the only partial php.ini mitigations, and the fact that watchTowr reproduced CVE-2026-109618 without observing in-the-wild exploitation. It also adds a behavioral detection strategy with named Elastic EDR and SIEM rules and PHP inventory queries, plus additional ATT&CK mappings (T1059, T1505.003).

    On October 20, 2026, details of two unauthenticated PHP core remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (nicknamed php2shell), leaked ahead of coordinated disclosure. The PHP security team rated both critical (CVSS v4.0 9.2) and moved the emergency release to October 21, 2026 at 14:00 UTC. Wiz Research reported the flaws, and watchTowr reproduced CVE-2026-109618 but had not observed in-the-wild exploitation. Elastic argues that, with no reliable public PoC, defenders should detect the convergent post-exploitation behavior: a web server or PHP worker process spawning a shell, downloading payloads or dropping webshells.

    Technical Details

    • CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is partially initialized, and request cleanup then treats the invalid data as valid.
    • CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state survives after its backing memory is freed, and a later request handled by the same worker may use the stale state before initialization resets it.
    • Both are reachable by an unauthenticated web request. Affected runtimes include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed; mod_php is flagged as highest risk because the issue can trigger before any application code runs.
    • Fix commit: 31c0ea7d7ff1d1fccb6492e52dab544011628065.
    • Mapped techniques: Exploit Public-Facing Application (T1190), Command and Scripting Interpreter (T1059) and Web Shell (T1505.003).
    • Expected post-exploitation flow: identity checks (id, whoami), privilege escalation enumeration (sudo -l, SUID search), interpreter staging (python -c, perl -e, php -r), curl/wget payload retrieval, inline base64 decoding, reverse shells, credential and cloud metadata harvesting (.env, ~/.aws/credentials, 169.254.169.254), webshell drops (.php/.phtml, double extensions) and persistence via cron, systemd or authorized_keys.
    • Elastic rules cited. EDR: Payload Execution by Web Server, Payload Downloaded via Curl or Wget by Web Server, Suspicious Web Server Child Process. SIEM: Suspicious/Unusual Command Execution via Web Server, Suspicious/Unusual Child Execution via Web Server, Unusual File Creation via/by Web Server, File with High Entropy Created by Web Server (requires Elastic Stack 9.3.0+), Web Shell Detection: Script Process Child of Common Web Processes.
    • Elastic notes coverage gaps are possible, for example account creation or fileless PHP script execution. It also provides Kibana and Osquery queries to inventory PHP installs on Linux and Windows.

    Remediation

    • Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, internet-facing systems first, and check distributions and hosting providers for backported packages.
    • PHP 8.1 and older are end of life (minimal source backports exist for 7.4, 8.0 and 8.1); upgrade, remove from the internet, or place behind a VPN or WAF.
    • The PHP team states there are no complete mitigations. Temporary exposure reduction only: memory_limit=-1 set non-overridably with a container/cgroup limit, a low post_max_size, session.upload_progress.enabled=0 with a restart of all workers, and fatal_error_backtraces=0 on PHP 8.5. Set these via php.ini, the FPM pool or server config; ini_set() and .user.ini do not help.
    • Enable the listed Elastic SIEM rules and Elastic Defend with prevention on PHP and web server hosts.
    • If compromise is suspected, isolate the host, preserve web server and PHP logs, and hunt for webshells, new web-root files, cron jobs, services and accounts.
27. blog.cloudflare.com ↗ · pub. 21/10/2026 10:56 · coletado 21/10 12:00

    php2shell: PHP memory flaws CVE-2026-109618 and CVE-2026-109619 exploited after leak; Cloudflare deploys WAF mitigations

    ler a análise desta fonte ocultar

    Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively named php2shell. They affect all web servers running PHP 5.4 or later and can allow denial of service, remote code execution and data exposure through specially crafted HTTP requests. The flaws leaked before the official disclosure date, and Cloudflare observed attack traffic against its customers, with attackers mutating payloads to evade its rules. Cloudflare worked with the PHP foundation, OpenAI and Wiz on coordinated mitigation. It deployed WAF rules from early October 2026, about 9 hours before public disclosure, and enabled them by default on all plans from 3:02 UTC on 21 October. Because PHP is used by almost 70% of websites and underpins platforms such as WordPress and Magento, the potential exposure is very large.

    Technical Details

    • Both flaws are memory-safety issues in how PHP handles errors while processing an HTTP request.
    • First flaw: PHP runs out of memory and stops before some internal data is initialized. During request cleanup it then treats that unfinished data as valid.
    • Second flaw: a fatal error leaves PHP holding references to memory that is freed when the request ends. A later request handled by the same PHP process may follow those stale references (use-after-free) and expose sensitive data.
    • By manipulating the data in this invalid memory, an attacker may crash a PHP process, leak information or execute attacker-supplied code. Large requests can create the memory pressure, but the impact goes beyond resource exhaustion.
    • The flaws are in the PHP runtime itself, so updating site code or plugins does not fix them.
    • Cloudflare built a new WAF capability, full transaction detection, which combines request and response signals within the same HTTP transaction and can block a matching origin response before it reaches the requester. The php2shell rules are its first managed detections.
    • New rules are in the Cloudflare Managed Free Ruleset (ID 77454fe2d30c4220b5701f6fdfb893ba), the Cloudflare Managed Ruleset (ID efb7b8c949ac4650a09736fc376e9aee) and the Managed Response Firewall Default (default block for high-confidence signatures).

    Remediation

    • Update PHP to the fixed version per the PHP advisory. If a hosting provider manages PHP, ask it to apply the security update.
    • Keep WAF protections enabled while patching. Paid-plan customers (Professional, Business, Enterprise) should confirm the Managed Ruleset is deployed in block mode.
    • Restricting unnecessary uploads and limiting upload sizes can reduce exposure but does not replace the patch.
    • Review blocked requests in Security > Security Analytics > Events, filtering by the rule IDs.
28. blog.checkpoint.com ↗ · pub. 21/10/2026 10:46 · coletado 21/10 12:00

    Leaked 'php2shell' critical PHP core RCE flaws CVE-2026-109618 and CVE-2026-109619 await out-of-cycle patch

    Check Point's blog adds a defender-oriented view from before the patch release: the PHP advance notice (19:33 UTC) moved the release a day earlier, to October 21 at 14:00 UTC. It adds a confidence-graded breakdown of what PHP confirmed versus what comes from researchers, no exploitation yet and no KEV listing, and a hunting checklist. It also gives Check Point mitigations, including keeping CPAI-2021-0286 in Prevent mode and a temporary WAF block on multipart/form-data POSTs.

    ler a análise desta fonte ocultar

    Check Point's blog adds a defender-oriented view from before the patch release: the PHP advance notice (19:33 UTC) moved the release a day earlier, to October 21 at 14:00 UTC. It adds a confidence-graded breakdown of what PHP confirmed versus what comes from researchers, no exploitation yet and no KEV listing, and a hunting checklist. It also gives Check Point mitigations, including keeping CPAI-2021-0286 in Prevent mode and a temporary WAF block on multipart/form-data POSTs.

    A Hacker News post on October 20 leaked two critical remote code execution (RCE) vulnerabilities in the PHP core interpreter, CVE-2026-109618 and CVE-2026-109619, dubbed php2shell by researchers. watchTowr confirmed the leak was genuine and reported reproducing CVE-2026-109618. The PHP security team announced an out-of-cycle release for both flaws, each rated CVSS v4.0 9.2 (the leak claimed 10.0), scheduled for October 21 at 14:00 UTC, with no workaround offered. No in-the-wild exploitation has been reported and neither CVE is in CISA's KEV catalog. Check Point warns that the patch diff will let attackers build exploits quickly and advises treating the next 72 hours as incident readiness.

    Technical Details

    • Only three facts come from PHP itself: two critical flaws, CVSS 9.2 each, and the release time. The CVE IDs and the php2shell name come from researchers and the leak.
    • Type (high confidence): RCE in the PHP core interpreter, so updating WordPress, Magento or Drupal alone will not fix it.
    • Authentication (medium confidence): likely none required, as inferred by CERT-EU from the score.
    • Affected versions (medium confidence): reportedly every version from PHP 5 onward (Sansec says 5.4+). PHP has not confirmed the range.
    • Fixes: only the supported branches 8.2, 8.3, 8.4 and 8.5 will be patched. PHP 8.1 and older stay exposed unless a distribution or vendor backports the fix.
    • Attack vector (low confidence): crafted multipart/form-data POST requests that reach PHP before any application script runs. One report describes CVE-2026-109618 as a use-after-free.
    • Screenshots of an exploit tool called PHP2Shell, claiming to work against PHP 5.4.0 and later, are circulating.
    • Mallory counted about 884,000 internet-facing hosts advertising PHP 8.1 or older in Shodan banners on October 20 (about 59% of ~1.5M hosts reporting a version), plus ~740,000 reporting PHP with no version. These are banner counts, not confirmed vulnerable systems.
    • The last comparable core PHP RCE, CVE-2024-4577, drew botnet scanning within about 24 hours of disclosure.
    • Hunting: unusual multipart POSTs, PHP worker crashes or segfaults, web server processes (php-fpm, httpd, www-data) spawning sh, bash, curl, wget, python or nc, new .php files in webroots, and new outbound traffic after inbound POSTs.

    Remediation

    • Inventory every PHP instance, internet-facing first. Include PHP-FPM pools, container images, vendor appliances, Windows software bundling php.exe or php-cgi.exe, and cPanel, Plesk and CMS platforms.
    • Stage the update path and book a change window for 14:00 UTC. At release, confirm versions against the php.net advisory, patch internet-facing hosts first, restart PHP-FPM or the web server, and verify the running version.
    • Plan for end-of-life PHP (8.1 and older): vendor backport, upgrade, or isolation behind a VPN or WAF. Track Ubuntu, Debian, Red Hat, SUSE and Alpine advisories.
    • Per CERT-EU, take internet-facing PHP applications offline or behind access control until patched.
    • Check Point: set IPS to Prevent and watch for a new CPAI entry. Keep CPAI-2021-0286 (PHP Webshell Upload Over HTTP) in Prevent mode. Temporarily block multipart/form-data POSTs on paths that do not accept uploads (this will break upload forms). Restrict outbound traffic from web servers.
    • Repeat hunting after the release, then again at 24 and 72 hours. If suspicious activity is found, isolate the server, preserve logs, and hunt for webshells, new cron jobs or scheduled tasks, and new accounts.
29. unit42.paloaltonetworks.com ↗ · pub. 21/10/2026 10:40 · coletado 21/10 12:00

    Unit 42 warns of PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 with PoC seen and 22.6M exposed instances

    Unit 42 adds that it has seen proof-of-concept code, that at least one European government took its website offline as a precaution, and that Cortex Xpanse telemetry shows over 22.6 million potentially vulnerable exposed instances (far above the 5.1 million PHP hosts estimated by VirusTotal). It also reports a Palo Alto Networks virtual patching signature (543004) available since October 20, 2026.

    ler a análise desta fonte ocultar

    Unit 42 adds that it has seen proof-of-concept code, that at least one European government took its website offline as a precaution, and that Cortex Xpanse telemetry shows over 22.6 million potentially vulnerable exposed instances (far above the 5.1 million PHP hosts estimated by VirusTotal). It also reports a Palo Alto Networks virtual patching signature (543004) available since October 20, 2026.

    Unit 42 published a threat brief on two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CVSS 4.0). Unit 42 has seen proof-of-concept code for the vulnerabilities, and at least one European government took its website offline as a precaution. Palo Alto Networks Cortex Xpanse telemetry identified over 22.6 million internet-exposed instances potentially vulnerable. Unit 42 urges defenders to assess exposure and patch immediately, following the PHP Group security advisory.

    Technical Details

    • CVE-2026-109618: out-of-memory (OOM) errors handled via longjmp() leave request memory uninitialized because of improper control flow management. Attackers can reliably achieve RCE by triggering OOM conditions.
    • CVE-2026-109619: longjmp() fatal error handling leaves global memory pointing to freed regions. These regions can be read or branched on during later requests, enabling arbitrary code execution.
    • Palo Alto Networks protections: Advanced Threat Prevention Plus with Frontier Virtual Patching (Threat Prevention signature 543004, available since October 20, 2026) on Next-Generation Firewall.
    • Cortex XDR, Cloud Runtime and XSIAM help against post-exploitation activity. Cortex Cloud Posture and Prisma Cloud Compute detect vulnerable PHP versions. Cortex Xpanse surfaces exposed assets through the PHP Attack Surface Rule.

    Remediation

    • Review the PHP Group security advisory and apply the patches immediately.
    • Assess internet-facing PHP exposure, for example with the Cortex Xpanse PHP Attack Surface Rule.
    • Enable the Threat Prevention signature 543004 where applicable.
30. bleepingcomputer.com ↗ · pub. 21/10/2026 11:07 · coletado 21/10 12:00

    PHP releases emergency patches for critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)

    The emergency release is now out. Fixed versions are confirmed as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports for PHP 7.4, 8.0 and 8.1. Cloudflare reports early attacks already observed in the wild, and the UK NCSC advised immediate patching or taking systems offline. The PHP team also published partial mitigations. The researchers who discovered the flaws are credited as Calif, Wiz and OpenAI. The article also confirms mod_php as the highest-risk configuration.

    ler a análise desta fonte ocultar

    The emergency release is now out. Fixed versions are confirmed as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports for PHP 7.4, 8.0 and 8.1. Cloudflare reports early attacks already observed in the wild, and the UK NCSC advised immediate patching or taking systems offline. The PHP team also published partial mitigations. The researchers who discovered the flaws are credited as Calif, Wiz and OpenAI. The article also confirms mod_php as the highest-risk configuration.

    The PHP security team released emergency patches for two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, tracked collectively as PHP2Shell. The flaws were found by researchers at Calif, Wiz and OpenAI and affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for mod_php, where a demonstrated exploit triggers the attack before any application code runs. Cloudflare CTO Dane Knecht said the company was already seeing early attacks against the two vulnerabilities before the patches shipped, and the UK NCSC told organizations to update immediately or take PHP systems offline. VirusTotal estimates over 5.1 million PHP hosts are exposed online.

    Technical Details

    • Both flaws stem from PHP leaving its memory in a corrupted state when a request ends abnormally.
    • CVE-2026-109618 allows RCE as the web worker account through a chain of weaknesses that trigger out-of-memory corruption.
    • CVE-2026-109619 is a stale global state bug that enables an unauthenticated heap use-after-free, memory disclosure and RCE with the web worker's privileges.
    • PHP core developer Gina Peter Banyard warned that no mitigation fully blocks attacks and that patching is the only permanent defense.
    • Cloudflare deployed temporary WAF rules against known exploitation methods.

    Remediation

    • Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on PHP 8.x servers. Migrate PHP 7 or earlier to a fixed release.
    • PHP 8.1 and older are no longer supported. Ask the distribution or LTS vendor for backported fixes. The PHP team also provided minimal source backports for PHP 7.4, 8.0 and 8.1.
    • Partial mitigations for CVE-2026-109618: set memory_limit=-1 in a way applications cannot override (e.g. php_admin_value), set a low post_max_size (8M, or 32M if uploads are needed), and use container or cgroup limits that kill only the affected worker.
    • Partial mitigations for CVE-2026-109619: set session.upload_progress.enabled=0 and restart all workers. On PHP 8.5, set fatal_error_backtraces=0. Remove settings that emit diagnostics before initialization. Fix attacker-reachable fatal errors and execution timeouts.
31. olhardigital.com.br ↗ · pub. 21/10/2026 09:31 · coletado 21/10 10:01

    Two critical PHP RCE flaws (CVSS 9.2) affecting versions since PHP 5; Cloudflare sees early exploitation ahead of patch

    ler a análise desta fonte ocultar

    Two critical remote code execution (RCE) vulnerabilities in PHP, rated 9.2/10 and reportedly affecting versions as far back as PHP 5, are expected to be fixed in a security release scheduled for 11:00 (Brasília time) on 21 October 2026. watchTowr describes the flaws as allowing attackers to run commands on affected servers, alter pages and steal data. Cloudflare says it is already seeing the first exploitation attempts, and Sansec expects mass attacks within minutes of the patch being published. One researcher estimates more than 1.3 million internet-facing servers may be vulnerable, and Wordfence says all WordPress sites are exposed because they depend on PHP.

    Technical Details

    • The article gives no CVE identifiers or technical root cause; the flaws are described as enabling unauthenticated-style remote code execution on servers running PHP, with a 9.2/10 severity rating.
    • The fix cannot be delivered through WordPress automatic updates. It must be applied to the PHP runtime, so hosting providers or server administrators must perform the update.
    • The PHP developers may release the patch early if details become public or active exploitation is evident.
    • GrapheneOS took its discussion forum offline while proof-of-concept exploits were being developed.
    • Cloudflare is temporarily adjusting its firewall rules to block early attacks, which is a stopgap only.

    Remediation

    • Install the PHP security update as soon as it is released. PHP developer Gina Peter Banyard states the patch is the only real mitigation.
    • Check whether your hosting provider has published guidance or applied the fix.
    • Restrict administrative access to servers and exposed applications.
    • Follow official PHP developer announcements.
    • If patching is not possible, EU and UK cybersecurity authorities recommend isolating internet-facing applications or taking them offline temporarily; Banyard says shutting servers down "may be the most sensible decision".
32. securityaffairs.com ↗ · pub. 21/10/2026 07:13 · coletado 21/10 10:00

    PHP schedules emergency release for php2shell flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 RCE) after details leaked

    Adds PHP's official advance notice (release October 21 at 14:00 UTC, no workaround, details withheld), a researcher claim that the bugs are heap use-after-free issues in the session.upload_progress handler, predicted fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), Mallory's Shodan exposure estimate (about 884,000 hosts on PHP 8.1 or older), Huntress's statement that it has seen no exploitation, and detection and hunting guidance.

    ler a análise desta fonte ocultar

    Adds PHP's official advance notice (release October 21 at 14:00 UTC, no workaround, details withheld), a researcher claim that the bugs are heap use-after-free issues in the session.upload_progress handler, predicted fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), Mallory's Shodan exposure estimate (about 884,000 hosts on PHP 8.1 or older), Huntress's statement that it has seen no exploitation, and detection and hunting guidance.

    The PHP security team announced an emergency security release for October 21, 2026 at 14:00 UTC, one day earlier than the leaked disclosure date. It addresses two critical flaws, CVE-2026-109618 and CVE-2026-109619 (dubbed php2shell), both rated CVSS v4.0 9.2. Leaked reports cited CVSS 10.0 and an impact reaching back to PHP 5, but PHP has not yet published technical details, affected versions or fixed versions. watchTowr confirmed the flaws are real and reproduced CVE-2026-109618 without releasing details. Huntress and watchTowr report no observed exploitation and no vendor patch at the time of writing. Mallory estimates about 884,000 internet-facing hosts report PHP 8.1 or older, which may not receive an upstream fix.

    Technical Details

    • A researcher post on X claims both flaws are heap use-after-free primitives in PHP's session.upload_progress handler (php_session_rfc1867_callback, ext/session/session.c). This is unverified and comes from outside the PHP project.
    • The RCE claim and the CVE identifiers come from reports outside PHP's advisory. The claim that all versions from PHP 5 onward are affected is not confirmed by any vendor advisory, and no configuration requirement has been described.
    • PHP currently supports branches 8.2 to 8.5. Mallory predicts the fixed versions will be PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These are predictions, not confirmed.
    • Mallory's Shodan data from October 20 shows about 1.5 million hosts disclosing a PHP version in HTTP banners, of which about 884,000 (roughly 59%) run PHP 8.1 or older. Another 740,000 hosts report PHP without a version. These counts are hosts, not sites or organizations, and do not prove vulnerability.
    • Precedent: after CVE-2024-4577 became public in June 2024, Akamai saw exploit attempts against its honeypots within 24 hours.
    • Suggested detection: on Linux, investigate php-fpm, php-cgi, httpd or apache2 spawning sh, bash, python, curl or wget. Florian Roth's open-source process-watcher can log these launches but does not block them.

    Remediation

    • Inventory all PHP deployments, including web servers, Windows hosts, vendor appliances, hosting panels (cPanel, Plesk) and applications bundling their own PHP runtime. Prioritize internet-facing and business-critical systems.
    • Patch as soon as fixed releases are published. Check with the Linux distribution and hosting provider, since fixes may be backported without changing the upstream version number.
    • Organizations running end-of-life PHP (8.1, 8.0, 7.x, 5.x) should upgrade to a supported branch, apply OS-vendor fixes, or reduce exposure via VPN or IP allowlisting, a WAF, or taking services offline.
    • CERT-EU advises isolating internet-facing applications from public networks if immediate patching is not feasible. This is a precaution, not a confirmed workaround.
    • If suspicious activity is found, isolate the server, preserve PHP and web server logs, and check web roots for new files and webshells, plus unexpected cron jobs, scheduled tasks and user accounts.
33. gbhackers.com ↗ · pub. 21/10/2026 09:02 · coletado 21/10 10:00

    Cloudflare reports early exploitation attempts against two critical unpatched PHP flaws; emergency WAF rules deployed

    ler a análise desta fonte ocultar

    Cloudflare warned that attackers are already attempting to exploit two critical PHP vulnerabilities ahead of an official fix. The PHP Foundation rated both flaws CVSS v4 9.2 and scheduled a security release for 21 October 2026 at 14:00 UTC. Cloudflare CTO Dane Knecht said emergency WAF rules covering known exploit vectors are live for all customers, including the free tier, and are being updated as new vectors appear. The article does not report attack volumes, targets, successful compromises, or whether working exploit code is public, so exploitation attempts should not be read as confirmed compromises.

    Technical Details

    • The article gives no CVE identifiers, affected version ranges, patched release numbers, vulnerability classes or exploitation prerequisites.
    • Claims of RCE or authentication bypass are unsupported by the source.
    • The headline says the flaws were "leaked", but the article does not say what leaked, where, or whether exploit code is available.
    • Cloudflare describes the WAF rules as a "stopgap measure" covering only known vectors, so they may not block every exploitation technique.

    Remediation

    • Prepare to apply the PHP security release as soon as the PHP Foundation publishes it.
    • Do not rely on WAF filtering as a substitute for patching.
    • Keep Cloudflare WAF protections enabled for PHP sites in the meantime.
34. thehackernews.com ↗ · pub. 21/10/2026 07:36 · coletado 21/10 09:00

    PHP2Shell: Two Critical PHP RCE Flaws (CVSS 9.2) Unpatched Ahead of 14:00 UTC Fix; Upload-Progress Workaround Insufficient

    ler a análise desta fonte ocultar

    Two critical PHP flaws dubbed PHP2Shell, each rated 9.2 out of 10, are due to be fixed in a PHP release at 14:00 UTC on October 21, 2026. PHP has not said which versions or components are affected and has offered no workaround of its own. No exploitation has been reported, and the flaws were absent from CISA's KEV catalog when last checked. GMO Flatt Security first suggested disabling session.upload_progress.enabled, then retracted that, saying the setting alone is not a complete fix and that bypasses are expected. PHP core developer Gina Peter Banyard said patching is the only mitigation. Defenders should prepare to patch immediately and reduce exposure until then.

    Technical Details

    • Attribution of the flaw to Session Upload Progress is unconfirmed. An anonymous independent audit argues the bug described in that feature does not exist in released PHP, and says the circulating proof-of-concept does not fire.
    • watchTowr reproduced one of the flaws and reports no confirmed patch or workaround. Upwind still lists the setting as a mitigation, relaying another researcher's analysis.
    • The setting is INI_PERDIR (php.ini, .htaccess, .user.ini). .user.ini is only read by CGI/FastCGI, and PHP re-reads it every 300 seconds by default.
    • A short demonstration video was posted and then removed.
    • Only PHP branches 8.2 through 8.5 receive fixes. Branches 8.1, 7.x and 5.x are end-of-life.
    • Cloudflare added emergency "anomalous execution" rules, but its changelog does not name PHP or these flaws.

    Remediation

    • Prepare to patch the runtime that serves web requests (PHP-FPM, mod_php or CGI) as soon as the fix ships. Rehearse changes and line up approvals for an emergency restart.
    • Until then, take exposed PHP off the internet or put it behind a VPN, allowlists or authenticated edge access. Verify the origin is not reachable directly.
    • Limit blast radius: reduce stored data and privileges, remove stored credentials including cloud roles, and keep logs enabled and stored securely.
    • Disabling session.upload_progress.enabled is harmless where unused, but do not treat it as protection. Verify it on the serving process, not with php -i.
    • Upgrade or isolate end-of-life branches. Updating WordPress, Laravel or similar does not update the PHP runtime. On managed hosting, ask the provider about fixed builds.
    • After patching, review logs for pre-patch activity and check php.net and PHP GitHub security advisories for fixed versions and any CVE IDs.
35. infosecurity-magazine.com ↗ · pub. 21/10/2026 07:20 · coletado 21/10 08:01

    PHP2Shell: CVE-2026-109618 and CVE-2026-109619 critical PHP RCE flaws leaked before scheduled patch release

    The article identifies the source of the leak as a now-deleted Hacker News forum post by user 'petecooper' on October 20, which cited a CVSS of 10.0 and an October 22 disclosure date. It adds that the UK NCSC issued an emergency advisory alongside CERT-EU, and that the PHP security team said it may release patches earlier if details become public or exploitation appears in the wild.

    ler a análise desta fonte ocultar

    The article identifies the source of the leak as a now-deleted Hacker News forum post by user 'petecooper' on October 20, which cited a CVSS of 10.0 and an October 22 disclosure date. It adds that the UK NCSC issued an emergency advisory alongside CERT-EU, and that the PHP security team said it may release patches earlier if details become public or exploitation appears in the wild.

    Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (dubbed PHP2Shell), were leaked ahead of the coordinated disclosure and patch release planned for October 21 at 2pm GMT. A Hacker News forum user, petecooper, posted the CVE identifiers on October 20, claiming a CVSS score of 10.0 and a disclosure date of October 22. The post has since been deleted. watchTowr confirmed the identifiers were genuine and scheduled for later disclosure. The PHP security team rated the flaws CVSS 9.2 and said it reserves the right to release earlier if details become public or exploitation appears in the wild. CERT-EU and the UK NCSC issued emergency advisories urging organizations to prepare for immediate patching.

    Technical Details

    • Both flaws are described as RCE allowing server takeover, and are said to affect PHP versions dating back to PHP 5. The article gives no root cause or attack path.
    • PHP is used by about 69.7% of websites with a known server-side language (W3Techs), including CMS platforms such as WordPress, Drupal, Joomla and Magento.
    • The article warns that leaking CVE details and affected version ranges before a patch can enable attackers to reverse engineer the fix and exploit the flaws.
    • Kevin Beaumont, inferring from PHP pre-release builds, listed the likely fixed versions on Mastodon. The article text does not include the list.

    Remediation

    • Prepare for immediate patching of affected PHP assets as soon as the fixed releases are published.
    • Where immediate patching is not feasible, CERT-EU advises isolating internet-facing applications from public networks until a fix is available.
36. tenable.com ↗ · pub. 21/10/2026 06:01 · coletado 21/10 08:00

    php2shell: Critical PHP RCE Flaws CVE-2026-109618 and CVE-2026-109619 Face Early Exploitation Ahead of Emergency Patch

    Compared with the earlier Huntress advisory, this article reports that exploitation is now emerging: Cloudflare's CTO says it is seeing early attacks and has deployed WAF rules for all customers, and watchTowr believes it has reproduced CVE-2026-109618. It also adds CERT-EU advisory 2026-018, the expected fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), the Firsov/LCFR/Calif.io exploit-chain video, internet exposure estimates of 1.3 to 1.9 million hosts, the conflicting CVSS 9.2 versus 10.0 ratings, and the history of PHP flaws in CISA KEV.

    ler a análise desta fonte ocultar

    Compared with the earlier Huntress advisory, this article reports that exploitation is now emerging: Cloudflare's CTO says it is seeing early attacks and has deployed WAF rules for all customers, and watchTowr believes it has reproduced CVE-2026-109618. It also adds CERT-EU advisory 2026-018, the expected fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), the Firsov/LCFR/Calif.io exploit-chain video, internet exposure estimates of 1.3 to 1.9 million hosts, the conflicting CVSS 9.2 versus 10.0 ratings, and the history of PHP flaws in CISA KEV.

    Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (dubbed php2shell), are due to be fixed in an emergency release on 21 October 2026 at 14:00 UTC. The PHP security team rates both CVSSv4.0 9.2, though some early reports say 10.0. Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging, and watchTowr says it believes it has reproduced CVE-2026-109618. The PHP security team has published no technical details. Fixes are expected only for supported PHP 8.x branches, so end-of-life branches are likely to stay exposed. PHP runs on roughly 69.3% of websites with a known server-side language, so the exposure is large.

    Technical Details

    • Public reporting describes both flaws as RCE. No root cause, affected component or attack path has been published.
    • CERT-EU (advisory 2026-018) says all versions from PHP 5 onward could be affected. A demonstration video references PHP 5.4.0 and later.
    • The exploit chain was demonstrated in a video shared by Kirill Firsov, who credited researcher LCFR and Calif.io. watchTowr says the disclosure was originally planned under embargo for 22 October.
    • Expected fixed versions, per Kevin Beaumont: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 5.x through 8.1.x are end-of-life with no fix expected.
    • Exposure estimates: Silas Cutler puts it at over 1.3 million potentially vulnerable internet-exposed hosts. A Shodan search by Henk Poley counts over 1.9 million internet-exposed PHP hosts.
    • Code claiming to exploit the flaws is circulating, but it is unverified and may contain malware.
    • Earlier PHP flaws in the CISA KEV catalog include CVE-2024-4577 and CVE-2019-11043, both known to have been used in ransomware campaigns.

    Remediation

    • Patch to the fixed PHP releases as soon as they ship, starting with internet-facing systems. Distribution packages may backport fixes, so check vendor advisories.
    • PHP developers say patching or upgrading is the only real mitigation. INI settings such as disabling session upload progress will not help.
    • Where patching is not possible, CERT-EU recommends isolating internet-facing applications from public networks until a fix is available.
    • Cloudflare WAF rules for the known exploit vectors are available to all tiers, including free. They are a stopgap and only cover traffic routed through Cloudflare.
    • Treat public PoC code with caution. Tenable plugins 48243, 58987, 200476 and 216936 identify PHP installations and unsupported versions.
37. huntress.com ↗ · pub. 21/10/2026 01:00 · coletado 21/10 05:00

    Huntress Rapid Response: Leaked PHP RCE Flaws CVE-2026-109618 and CVE-2026-109619 (php2shell) Ahead of Patch Release

    Huntress adds defender-oriented guidance: expected post-exploitation behavior (PHP worker processes spawning shells, interpreters or download tools), an unrelated recent PHP FastCGI abuse incident, confirmation of existing Linux/Windows webshell detections, and a statement that it has no PoC and knows of no public exploit code. It also reports that a short exploitation video was briefly posted and removed, and that no IOCs have been confirmed.

    ler a análise desta fonte ocultar

    Huntress adds defender-oriented guidance: expected post-exploitation behavior (PHP worker processes spawning shells, interpreters or download tools), an unrelated recent PHP FastCGI abuse incident, confirmation of existing Linux/Windows webshell detections, and a statement that it has no PoC and knows of no public exploit code. It also reports that a short exploitation video was briefly posted and removed, and that no IOCs have been confirmed.

    Huntress published a rapid-response advisory on two leaked critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, informally named "php2shell". Both are rated CVSS v4.0 9.2 and are publicly described as remote code execution. The details leaked via a removed Hacker News post, and watchTowr confirmed they are real. The PHP security team moved the security release up to 21 October 2026 at 14:00 UTC, and reserves the right to release sooner if details become public or exploitation appears. Huntress is not aware of public exploit code or in-the-wild exploitation and has not reproduced a PoC. It expects technical details and PoCs to follow quickly once fixes ship.

    Technical Details

    • No root cause, affected component or attack path has been published. It is unknown whether the flaws are reachable via a plain web request or depend on configuration.
    • Reports point to PHP 5, 6, 7 and 8 being affected, and some researchers expect fixes only for supported PHP 8 branches. Official affected and fixed versions are due with the 21 October release.
    • Likely exploitation pattern: PHP worker processes (php-fpm, php-cgi, php-cgi.exe, httpd, apache2) spawning shells (sh, bash, cmd.exe, powershell.exe), interpreters (python, perl) or download/network tools (curl, wget, nc, certutil.exe), plus reverse shell command lines and recon commands (whoami, id, uname -a, ipconfig).
    • Huntress observed an unrelated incident the prior week in which a PHP FastCGI process repeatedly wrote a small PHP file with random marker strings to the first writable temp directory, executed it and deleted it, printing !notwrtbl! if no directory was writable.
    • A short exploitation video was briefly posted online and removed. No IOCs have been confirmed.
    • Huntress already detects web server processes spawning shells and common webshell activity on Windows and Linux, and captured a baseline of normal PHP behavior across partner endpoints for comparison after release.

    Remediation

    • Inventory all PHP installs, including bundled php.exe/php-cgi.exe in vendor appliances and Windows software, control panels (cPanel, Plesk) and CMS platforms (WordPress, Drupal, Joomla, Magento).
    • Plan the patch window for 21 October 2026 at 10:00 ET. Patch internet-facing systems first and check distributions and hosting providers for backported packages.
    • Upgrade or isolate end-of-life environments (PHP 5, 7, 8.0/8.1) behind a VPN or WAF, as they may receive no fix.
    • Alert on PHP workers launching shells, interpreters or download tools. On Linux servers without EDR, deploy Florian Roth's process-watcher in observe mode.
    • If compromise is suspected, isolate the server, preserve web server and PHP logs, and look for webshells, new web root files, cron jobs, scheduled tasks and accounts.
38. securityweek.com ↗ · pub. 21/10/2026 04:02 · coletado 21/10 05:00

    PHP2Shell: Leaked Critical PHP RCE Flaws CVE-2026-109618 and CVE-2026-109619 Face Imminent Mass Exploitation

    Adds the confirmed patch timing (21 October 2026, 14:00 UTC) and a CVSS 9.2 rating for both flaws. WatchTowr says it reproduced CVE-2026-109618, and one report suggests that flaw is a use-after-free bug. CERT-EU infers unauthenticated exploitability from the CVSS score. Sansec predicts mass exploitation within 15 minutes of the patch release, while WatchTowr and Huntress still report no in-the-wild exploitation.

    ler a análise desta fonte ocultar

    Adds the confirmed patch timing (21 October 2026, 14:00 UTC) and a CVSS 9.2 rating for both flaws. WatchTowr says it reproduced CVE-2026-109618, and one report suggests that flaw is a use-after-free bug. CERT-EU infers unauthenticated exploitability from the CVSS score. Sansec predicts mass exploitation within 15 minutes of the patch release, while WatchTowr and Huntress still report no in-the-wild exploitation.

    Details of two critical PHP vulnerabilities dubbed PHP2Shell leaked online ahead of coordinated disclosure. Both are rated CVSS 9.2 and could lead to remote code execution. PHP has scheduled patches for 21 October 2026 at 14:00 UTC and warned that it may release them earlier if technical details are published or in-the-wild exploitation appears. WatchTowr says it reproduced one flaw, and Sansec expects mass exploitation within 15 minutes of the patch release. WatchTowr and Huntress have not observed exploitation so far.

    Technical Details

    • The flaws are reportedly tracked as CVE-2026-109618 and CVE-2026-109619. CERT-EU says the CVSS scores imply exploitation without authentication.
    • Public details do not include a root cause, affected component or attack path. One report suggests CVE-2026-109618 is a use-after-free bug.
    • Public reporting suggests all PHP versions from PHP 5 onwards are affected. This is unconfirmed.
    • WatchTowr CEO Benjamin Harris confirmed the vulnerabilities are real and that the firm reproduced CVE-2026-109618, but it is withholding technical details until patches ship.
    • Sansec predicts mass exploitation will start within 15 minutes of the patch release.

    Remediation

    • Prepare to upgrade PHP as soon as the release is available, as PHP urges. Prioritize internet-facing systems.
    • Monitor for earlier out-of-cycle releases, since PHP may ship the fix ahead of schedule.
39. thehackernews.com ↗ · pub. 21/10/2026 01:57 · coletado 21/10 03:00

    PHP to ship out-of-cycle fix for two unpatched CVSS 9.2 RCE flaws ("php2shell") after embargo leak; no exploitation reported

    Adds the leak chronology (the October 20 HN post claiming CVSS 10.0 and PHP 5+ scope, confirmed as real by watchTowr), the "php2shell" nickname, and the fact that only PHP 8.2 to 8.5 will be patched while end-of-life branches get no fix. Includes Mallory's Shodan banner count of about 884,000 hosts on PHP 8.1 or older, Huntress's finding of no exploitation or public PoC, and a six-step preparation and detection checklist drawing on Huntress, CERT-EU and Florian Roth.

    ler a análise desta fonte ocultar

    Adds the leak chronology (the October 20 HN post claiming CVSS 10.0 and PHP 5+ scope, confirmed as real by watchTowr), the "php2shell" nickname, and the fact that only PHP 8.2 to 8.5 will be patched while end-of-life branches get no fix. Includes Mallory's Shodan banner count of about 884,000 hosts on PHP 8.1 or older, Huntress's finding of no exploitation or public PoC, and a six-step preparation and detection checklist drawing on Huntress, CERT-EU and Florian Roth.

    The PHP security team announced an out-of-cycle release for 14:00 UTC on October 21, 2026, fixing two vulnerabilities rated CVSS v4.0 9.2. The notice did not describe them. watchTowr says both allow remote code execution, and researchers are calling the pair php2shell, a name that is theirs, not PHP's. The notice followed an October 20 leak on HN that claimed two RCE flaws rated CVSS 10.0, affecting PHP 5 onward, would be disclosed on October 22. watchTowr confirmed the leak was real and that the flaws were under embargo. No exploitation has been reported and the flaws are not in CISA's KEV catalog. Only PHP 8.2 to 8.5 will receive fixes, so end-of-life branches could be left without a vendor patch.

    Technical Details

    • The leaked identifiers CVE-2026-109618 and CVE-2026-109619 are not named in PHP's notice. The CVSS 10.0 score and the "every version since PHP 5" scope come from the leak and are unconfirmed. PHP's own rating is 9.2 on CVSS v4.0.
    • No affected component, attack vector, authentication requirement or configuration prerequisite has been described. PHP says full details and fixed versions will be published with the release.
    • The notice says PHP may release earlier if details become public or exploitation appears in the wild.
    • Supported branches are 8.2 and 8.3 (security fixes only) and 8.4 and 8.5 (active support). PHP 8.1, 8.0, 7.x and 5.x are end of life and get no fix.
    • Mallory counted about 884,000 internet-facing hosts whose HTTP banner reported PHP 8.1 or older on October 20 (59% of roughly 1.5 million hosts reporting a version). A further 740,000 hosts reported PHP without a version. These are banner counts, not confirmed affected systems.
    • Huntress had seen no exploitation in its partner environments as of October 20 and was not aware of public exploit code or a proof of concept. By comparison, CVE-2024-4577 saw exploit attempts against Akamai honeypots within 24 hours of disclosure.

    Remediation

    • Inventory every PHP install, including PHP bundled in vendor appliances, Windows software and control panels such as cPanel and Plesk.
    • Be ready to upgrade at 14:00 UTC and patch internet-facing systems first. Check your Linux distribution and hosting provider for backported packages.
    • On end-of-life branches, upgrade, take the system off the internet, or place it behind a VPN or WAF. CERT-EU advises considering isolating internet-facing applications from public networks until a fix is available.
    • Alert on php-fpm, php-cgi, httpd or apache2 launching shells, interpreters or download tools. Florian Roth's process-watcher can log every program a PHP process starts on Linux servers without EDR, but it prevents nothing.
    • If compromise is suspected, isolate the server and preserve web server and PHP logs. Look for web shells, new files in the web root, new cron jobs, scheduled tasks and accounts.
40. gbhackers.com ↗ · pub. 21/10/2026 01:47 · coletado 21/10 02:00

    PHP maintainers pre-announce two CVSS 9.2 RCE flaws (CVE-2026-109618/109619 per watchTowr); patch due Oct 21, 2026

    This article adds watchTowr's caveats: the CVE identifiers and the 'PHP 5 onward' scope are unverified, and the two 9.2 scores are not confirmed as belonging to CVE-2026-109618 and CVE-2026-109619. It notes a conflicting rumored announcement time (October 22, 18:00 CEST) versus PHP's official October 21, 14:00 UTC. It also states that PHP may release patches early if details leak or exploitation emerges, that watchTowr saw no known exploitation as of October 21, and that teams should not rely on speculative configuration changes.

    ler a análise desta fonte ocultar

    This article adds watchTowr's caveats: the CVE identifiers and the 'PHP 5 onward' scope are unverified, and the two 9.2 scores are not confirmed as belonging to CVE-2026-109618 and CVE-2026-109619. It notes a conflicting rumored announcement time (October 22, 18:00 CEST) versus PHP's official October 21, 14:00 UTC. It also states that PHP may release patches early if details leak or exploitation emerges, that watchTowr saw no known exploitation as of October 21, and that teams should not rely on speculative configuration changes.

    The PHP security team published an advance notice on October 20, 2026 for a release at 14:00 UTC on October 21 that fixes two vulnerabilities, each rated CVSS v4.0 9.2. watchTowr reports them as two possible remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Its report is unverified, and PHP has not confirmed the identifiers, the technical details, or which CVE carries which score. watchTowr's reported scope is every PHP version from PHP 5 onward, but the maintainers have not verified this. PHP may release patches earlier if details become public or exploitation appears. As of October 21, watchTowr reported no known in-the-wild exploitation.

    Technical Details

    • Two RCE vulnerabilities, each scored 9.2 under CVSS v4.0 in the official notice. The notice does not tie the scores to named CVEs.
    • watchTowr's FAQ says the flaws could let attackers run their own code on affected PHP servers.
    • No affected components, vulnerable functions, attack vectors, authentication requirements or configuration prerequisites have been disclosed.
    • watchTowr's FAQ cites a rumored announcement on October 22 at 18:00 CEST, circulated via social media. This conflicts with PHP's official October 21, 14:00 UTC schedule.
    • No IOCs or exploitation evidence are available.

    Remediation

    • Follow the vendor's published schedule and monitor official PHP security channels. Install the confirmed fixed versions as soon as they are released.
    • Inventory production PHP installations, identify the application owners, and prepare update procedures before the release.
    • No workaround or affected-version matrix has been confirmed. Avoid relying on speculative configuration changes.
41. aikido.dev ↗ · pub. 20/10/2026 22:54 · coletado 21/10 01:00

    PHP leaked critical RCE flaws CVE-2026-109618 and CVE-2026-109619 (php2shell): patches due Oct 21, all versions treated as affected

    Aikido says that independent researchers confirmed the leaked flaws and that the release was moved up to October 21 because of the leak. It advises treating all PHP versions as affected and says it is coordinating the disclosure with the PHP Foundation. It dubs the issue "php2shell", says the vulnerabilities are still circulating, and promises workarounds and patches with the release.

    ler a análise desta fonte ocultar

    Aikido says that independent researchers confirmed the leaked flaws and that the release was moved up to October 21 because of the leak. It advises treating all PHP versions as affected and says it is coordinating the disclosure with the PHP Foundation. It dubs the issue "php2shell", says the vulnerabilities are still circulating, and promises workarounds and patches with the release.

    Aikido warns that two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP itself, and it advises treating all versions as affected. Both are rated CVSS v4.0 9.2. The PHP security team will release fixes at 14:00 UTC on October 21, 2026. Aikido is coordinating the disclosure with the PHP Foundation. The team published an advance notice on October 20 after details leaked ahead of the planned date. Independent researchers confirmed the flaws were real, so the release was moved up to October 21, and the vulnerabilities are still circulating. Aikido refers to the issue as "php2shell" and is withholding exploitation details until patches are available.

    Technical Details

    • Both flaws are remote code execution issues with a CVSS v4.0 score of 9.2.
    • Aikido says all PHP versions should be treated as affected. The article gives no specific version ranges.
    • No exploitation details, IOCs or evidence of in-the-wild exploitation are provided.
    • The article's sidebar links to unrelated supply-chain stories (tensorlake npm compromised with the Shai Hulud worm, the supplychain.local Go worm, the Graphalgo campaign). They are not analysed here.

    Remediation

    • Be ready to deploy the PHP security release as soon as it is published on October 21 at 14:00 UTC.
    • Inventory all PHP deployments in the stack, especially internet-facing ones.
    • Watch Aikido and the official PHP site for workarounds and patches.
42. bleepingcomputer.com ↗ · pub. 20/10/2026 17:56 · coletado 20/10 18:00 primeiro registro

    PHP warns of emergency patches for two leaked critical RCE flaws, CVE-2026-109618 and CVE-2026-109619

    ler a análise desta fonte ocultar

    The PHP security team has warned administrators to prepare for emergency security updates on October 21 at 14:00 UTC, fixing two critical vulnerabilities each rated 9.2 under CVSS v4.0. Information about the flaws reportedly leaked ahead of the planned embargo, and the team says it may release earlier if details become public or exploitation appears in the wild. watchTowr told BleepingComputer the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution (RCE) issues believed to affect PHP versions 5, 6, 7 and 8, and that it believes it has reproduced CVE-2026-109618. watchTowr has not observed exploitation in the wild and is withholding technical details until patches are available. The leak followed a now-deleted Hacker News post by user "petecooper" that named both CVE IDs.

    Technical Details

    • PHP has not published affected versions, exploitation details or fixed releases; these are due with the security release.
    • watchTowr and the Hacker News post describe both flaws as CVSS 10.0, while PHP's advisory rates each 9.2 (CVSS v4.0).
    • The disclosure date is also inconsistent: watchTowr and the Hacker News post cite October 22 (Thursday), while PHP has scheduled the release for October 21.
    • The affected version range (PHP 5 to 8) comes from watchTowr and is not confirmed by PHP.

    Remediation

    • Prepare to deploy the PHP security updates as soon as they are released on October 21 at 14:00 UTC, or earlier if PHP releases ahead of schedule.
    • Inventory internet-facing PHP applications (CMS, e-commerce, custom services) and identify the PHP versions in use.
    • Monitor the PHP ANNOUNCE mailing list and the official advisory for affected versions and fixed releases.

Repetiram sem novidade

• schneier.com — PHP patches two critical unauthenticated RCE flaws, CVE-2026-109618 and CVE-2026-109619, in PHP 8.2 to 8.5
• theregister.com — PHP2Shell exploitation surges to millions of attempts; Amazon MadPot saw first attack on Oct 17, four days before patches
• gbhackers.com — PHP patches two critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) in 8.5.12, 8.4.27, 8.3.36, 8.2.35
• github.com — PHP2Shell: Qi Deng's PoC repo mirrored on GitHub details five attack chains for CVE-2026-109618 and CVE-2026-109619
• theregister.com — PHP releases emergency fixes for critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619 as exploitation begins
• cyberscoop.com — PHP ships emergency patches for critical php2shell RCE flaws CVE-2026-109618 and CVE-2026-109619 as early attacks emerge