PHP2Shell: PHP patches critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619 as exploitation attempts begin

Linha do tempo

1. security.paloaltonetworks.com ↗ · pub. 21/10/2026 13:00 · coletado 21/10 14:02

   Palo Alto Networks: PAN-OS and Panorama affected by critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619; fix pending

   Palo Alto Networks has confirmed that all PAN-OS and Panorama versions are affected. It rates the issue HIGH (CVSS-B 8.7 with internet-exposed management interface), has no fixed releases yet, and reports no known exploitation against its products. It has published interim mitigations: Threat ID 543004 for Frontier Virtual Patching customers and IPS signatures 543004 and 97622-97625 from Oct 21, plus management interface access restrictions.

   ler a análise desta fonte ocultar

   Palo Alto Networks has confirmed that all PAN-OS and Panorama versions are affected. It rates the issue HIGH (CVSS-B 8.7 with internet-exposed management interface), has no fixed releases yet, and reports no known exploitation against its products. It has published interim mitigations: Threat ID 543004 for Frontier Virtual Patching customers and IPS signatures 543004 and 97622-97625 from Oct 21, plus management interface access restrictions.

   Palo Alto Networks published a PSIRT advisory on the impact of two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on its products. All versions of PAN-OS and Panorama are listed as vulnerable, and no special configuration is required to be affected. The vendor rates the issue HIGH with suggested urgency MODERATE and is not aware of any malicious exploitation against its products. Fixed PAN-OS releases have not yet been published and will be added to the advisory later. Interim protection relies on Threat Prevention signatures and on restricting management interface access.

   Technical Details

   • CVE-2026-109618: handling of out-of-memory errors via longjmp() leaves request memory uninitialized because of improper control flow, which allows reliable RCE through OOM triggers.
   • CVE-2026-109619: longjmp() fatal error handling leaves global memory pointing to freed regions, which can be read or branched on in later requests and lead to arbitrary code execution.
   • Weakness and pattern: CWE-754 and CAPEC-153.
   • Risk is highest on PAN-OS when the management interface is reachable from external internet IPs. The vendor's CVSS-B score is 8.7 for that exposure and 7.1 when access is limited to a jump box.
   • The advisory also cites a separate CVSS-B of 9.2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) against a "Vendor" label, which appears to be the base score for the underlying PHP flaws.

   Remediation

   • Restrict management interface access to trusted internal IP addresses only, ideally through a single jump box, in line with vendor best practice.
   • Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage via Threat ID 543004, released on Oct 20.
   • Advanced Threat Prevention will release standard IPS coverage (signatures 543004, 97622, 97623, 97624, 97625) on Oct 21.
   • Apply the PAN-OS fixed releases once published, and monitor the advisory for updates. Unit 42 has further details on product protections.
2. cisa.gov ↗ · pub. 21/10/2026 09:00 · coletado 21/10 14:02

   CISA urges immediate patching of critical unauthenticated PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 (php2shell)

   This is the CISA government advisory on php2shell. It adds that CISA had not observed exploitation as of publication, names the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), and recommends taking unpatched or unsupported (8.1 and earlier) PHP systems offline. It also advises monitoring for PHP worker processes launching shells or downloading tools.

   ler a análise desta fonte ocultar

   This is the CISA government advisory on php2shell. It adds that CISA had not observed exploitation as of publication, names the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), and recommends taking unpatched or unsupported (8.1 and earlier) PHP systems offline. It also advises monitoring for PHP worker processes launching shells or downloading tools.

   CISA issued an alert urging organizations to immediately patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as php2shell. The flaws allow unauthenticated remote code execution and affect all PHP installations serving web requests. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA states it has not observed exploitation as of publication but stresses the risk to unpatched systems.

   Technical Details

   • The vulnerabilities permit unauthenticated remote code execution in PHP; the advisory gives no root-cause detail.
   • PHP is often embedded in other software, so its presence may not be directly observable.
   • Suggested detection focus: PHP worker processes launching shells or downloading tools.

   Remediation

   • Identify and inventory all systems running any version of PHP, including PHP bundled in other software.
   • Apply the patches immediately, prioritizing internet-facing systems.
   • Take PHP-based systems offline until patched if they cannot be updated immediately, or if they run unsupported versions (PHP 8.1 or earlier).
   • A web application firewall may provide some interim protection.
   • Review the official PHP security advisory and monitor for suspicious activity such as PHP workers spawning shells or downloading tools.
3. securelist.com ↗ · pub. 21/10/2026 12:18 · coletado 21/10 14:00

   PHP2Shell: Kaspersky details detections for critical unauthenticated PHP RCE flaws CVE-2026-109618 and CVE-2026-109619

   This Kaspersky write-up adds vendor detection coverage (KEDR rules, KATA network verdicts and Behavior Detection PDM signatures), Sansec's estimate that mass exploitation could begin within 15 minutes of the patch release, and a technical characterization of the flaws as use-after-free and memory corruption tied to multipart/form-data handling and session.upload_progress. It also lists interim mitigations: disabling session.upload_progress in PHP-FPM pools and blocking multipart requests on nginx and Apache.

   ler a análise desta fonte ocultar

   This Kaspersky write-up adds vendor detection coverage (KEDR rules, KATA network verdicts and Behavior Detection PDM signatures), Sansec's estimate that mass exploitation could begin within 15 minutes of the patch release, and a technical characterization of the flaws as use-after-free and memory corruption tied to multipart/form-data handling and session.upload_progress. It also lists interim mitigations: disabling session.upload_progress in PHP-FPM pools and blocking multipart requests on nginx and Apache.

   On October 20, 2026 the PHP security team announced an emergency release for two critical flaws, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), and patches shipped on October 21 at 14:00 UTC. The release was moved up after details leaked on Hacker News ahead of the embargo, together with an exploit unofficially named PHP2Shell. A leaked demo video shows the exploit running against servers hosting WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS, though its authenticity and exact behavior were not independently verified. The flaws allow unauthenticated remote code execution as the PHP process and reportedly affect all versions from PHP 5.4.0. Sansec estimates mass exploitation could start within 15 minutes of the patch release. Kaspersky published guidance and detection coverage for the activity.

   Technical Details

   • According to the PoC author, the bugs involve handling of the multipart/form-data MIME type together with the session upload progress mechanism (session.upload_progress) in the PHP core, and fall into use-after-free and memory corruption classes. They cannot be fixed in application code; only a PHP update resolves them.
   • Versions 5, 6, 7 and 8 are affected. Supported branches are 8.2 to 8.5. Branches 8.1, 8.0, 7.x and 5.x are end-of-life, but backported patches were released for 7.4, 8.0 and 8.1.
   • Kaspersky Endpoint Detection and Response rules: creating_windows_shell_from_a_web_servers_process, possible_web_shell_creating_via_exploit, spawning_process_from_webserver_more_filters_linux, webserver_interpreter_execution_linux, executable_file_in_www_folder.
   • Kaspersky Anti Targeted Attack (KATA) network verdicts: Exploit.CVE-2026-109618.HTTP.C&C and Exploit.CVE-2026-109619.HTTP.C&C.
   • Kaspersky Endpoint Security / Kaspersky Next Behavior Detection: PDM:Exploit.Linux.Generic and PDM:Exploit.Win32.Generic.

   Remediation

   • Inventory all PHP-based systems, including web servers, control panels and third-party software.
   • Apply the PHP patches immediately. Migrate servers on unsupported branches (8.1 and earlier) to a current PHP branch.
   • As interim mitigation, set session.upload_progress.enabled = Off via php_admin_flag in PHP-FPM pools, and block multipart requests on nginx and Apache.
   • Consider temporarily isolating internet-facing PHP applications until patched.
4. securityweek.com ↗ · pub. 21/10/2026 13:50 · coletado 21/10 14:00

   PHP2Shell: PHP patches critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619 as in-the-wild exploitation attempts begin

   Adds the first confirmed in-the-wild exploitation reports: watchTowr saw attempts at patch time with no success, and Hadrian reported at-scale exploitation, mostly via PHP's session upload-progress path. Patchstack, Cloudflare and Vega also saw attempts, and Vega's used a public PoC. It also details discovery by Wiz, OpenAI and Calif using frontier AI (reported August 11), and says the flaws group four memory-safety issues with likely untracked variants. It reports further leaks: a PoC video published early, and Chainguard fixed images released six hours before the coordinated release. It notes that 15 PHP CVEs have been published since July 1.

   ler a análise desta fonte ocultar

   Adds the first confirmed in-the-wild exploitation reports: watchTowr saw attempts at patch time with no success, and Hadrian reported at-scale exploitation, mostly via PHP's session upload-progress path. Patchstack, Cloudflare and Vega also saw attempts, and Vega's used a public PoC. It also details discovery by Wiz, OpenAI and Calif using frontier AI (reported August 11), and says the flaws group four memory-safety issues with likely untracked variants. It reports further leaks: a PoC video published early, and Chainguard fixed images released six hours before the coordinated release. It notes that 15 PHP CVEs have been published since July 1.

   PHP released patches on October 21, 2026 for two critical flaws dubbed PHP2Shell, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state). Both are rated CVSS 9.2 and allow unauthenticated remote code execution, confirmed on Apache with mod_php. watchTowr saw the first in-the-wild exploitation attempts around the time the patches landed, but no successful attempts. Hadrian reported exploitation "at scale" a few hours before the fixes shipped, mostly abusing PHP's session upload-progress path. Patchstack, Cloudflare and Vega also observed attempts, and Vega's leveraged a public PoC. The flaws affect nearly all PHP releases back to 5.4, and the PHP Foundation says every PHP installation that handles web requests is potentially at risk. The flaws can also be used to read sensitive process memory, which may hold credentials and API keys.

   Technical Details

   • Both flaws sit in core PHP, in memory management and error handling, so they are independent of the CMS. The article says they affect about 70% of websites, including WordPress, Drupal and MediaWiki.
   • Affected runtimes: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
   • Wiz says the two CVEs group four memory-safety issues but do not cover all variants. Both tracked and likely untracked variants exist.
   • Wiz, OpenAI and Calif found the flaws in August using frontier AI models. Calif and OpenAI independently reported the OOM-to-RCE chain on August 11, and OpenAI and Wiz later reported additional vectors. An OOM flaw was first found in 2020 and again in a 2024 audit, but was not patched because exploitation was unproven.
   • The planned disclosure date was October 22. Information leaked online on October 20, so the PHP Foundation moved the release up by a day.
   • A video showing a working PoC was published early and accelerated the development of PoCs.
   • Chainguard published images containing the fix six hours before the coordinated release, which let attackers study the fix in binary form.
   • Cloudflare deployed protections nine hours before public disclosure.
   • Since July 1, 15 new PHP CVEs have been published, which the PHP Foundation attributes to AI-assisted discovery.

   Remediation

   • Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Minimal source backports exist for PHP 7.4, 8.0 and 8.1.
   • Where patching is not possible, interim measures reduce exposure to specific attack paths but do not make an installation safe.
   • Inventory where PHP runs, and pre-authorize who can approve urgent changes.
   • Verify that the update took effect.
   • Check whether systems were compromised before the fix was applied, and rotate credentials and API keys that may have been exposed from process memory.
5. thehackernews.com ↗ · pub. 21/10/2026 11:00 · coletado 21/10 14:00

   PHP patches two critical unauthenticated RCE flaws (PHP2Shell, CVE-2026-109618/109619) as early exploit attempts emerge

   Adds technical and operational detail beyond the known case: mod_php is the highest-risk SAPI with a single-request pre-application exploit, and the FPM exposure differs per CVE. It also gives per-CVE interim mitigations, noting that disabling session upload progress was never a complete fix. Further additions are detection guidance (multipart requests with memory-limit errors or HTTP 500s, oversized PHPSESSID cookies, worker restarts), BambooHR's precautionary outage, and the researchers' statement that AI helped weaponize the decade-old flaws. It also confirms that no successful exploitation had been reported and that neither CVE was in CISA KEV at the time.

   ler a análise desta fonte ocultar

   Adds technical and operational detail beyond the known case: mod_php is the highest-risk SAPI with a single-request pre-application exploit, and the FPM exposure differs per CVE. It also gives per-CVE interim mitigations, noting that disabling session upload progress was never a complete fix. Further additions are detection guidance (multipart requests with memory-limit errors or HTTP 500s, oversized PHPSESSID cookies, worker restarts), BambooHR's precautionary outage, and the researchers' statement that AI helped weaponize the decade-old flaws. It also confirms that no successful exploitation had been reported and that neither CVE was in CISA KEV at the time.

   The PHP project released emergency updates on October 21, 2026 for two critical flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. They allow unauthenticated code execution on web servers and are rated CVSS v4.0 9.2. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws were found by Wiz Research, Calif and OpenAI's Codex Security team and affect nearly every PHP version back to 5.4. The release was pulled forward a day after details leaked. Cloudflare reported early exploit attempts before the patch shipped. No source has confirmed a successful break-in, and neither CVE was in CISA's KEV catalog at the time of reporting.

   Technical Details

   • The flaws sit in the PHP engine, not in application code, so even a minimal "Hello World" page on a vulnerable version is exposed. Affected SAPIs include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
   • mod_php is the highest risk: a demonstrated exploit triggers with a single unauthenticated request before any application code runs.
   • PHP-FPM behaves differently because it shuts the worker down when a request fails early in setup. For CVE-2026-109618, FPM is judged susceptible but no complete FPM exploit has been shown. CVE-2026-109619 was shown to reach code execution on both mod_php and PHP-FPM, though the FPM path depends on an operation inside the running application.
   • An attacker can also read live memory from the PHP worker process, which may hold passwords, tokens, API keys and certificates from other requests, without first gaining code execution.
   • Session upload progress is on by default and takes part in one confirmed attack path for CVE-2026-109619. Disabling it does nothing for CVE-2026-109618.
   • The researchers say AI models helped turn these decade-old flaws into working exploits, letting one researcher do in about a week what would otherwise take a team months. Calif traced the bug lineage to PHP research from 2004.
   • Precautionary outages: BambooHR took its service offline in the US, Canada and Ireland. In the Netherlands, MijnOverheid, DigiD, the lower house's site, the national cyber-security center and several education systems went offline, per NOS.

   Remediation

   • Update the PHP runtime that serves web requests, then restart Apache, PHP-FPM and any long-running PHP workers. Updating WordPress or Laravel does not update the underlying runtime, which comes from the server package, host or container image.
   • Distribution packages may carry the fix under an old-looking version, so check the package changelog for the CVE rather than the version string.
   • PHP published source backports for PHP 7.4, 8.0 and 8.1. PHP 8.2 reaches end of life on December 31, 2026.
   • Interim mitigations only reduce exposure. For CVE-2026-109618, set memory_limit=-1, keep post_max_size low and enforce request-size limits at the web server or proxy. Do not use RLIMIT_AS or RLIMIT_DATA. For CVE-2026-109619, set session.upload_progress.enabled=0 and restart workers, and on PHP 8.5 also set fatal_error_backtraces=0.
   • After patching, review memory_limit and post_max_size, because the new hard memory limit ends the process and skips shutdown handlers.
   • Hunt for unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, oddly large PHPSESSID response cookies, and unexplained PHP worker restarts.
6. wired.com ↗ · pub. 21/10/2026 11:26 · coletado 21/10 12:01

   PHP Foundation patches critical CVE-2026-109618 and CVE-2026-109619 as early attacks emerge and government sites go offline

   The patches have now been released (just before 10 am ET on October 21). Cloudflare reports early attacks emerging before release. Government and port websites in Finland, France and the Netherlands (Port of Rotterdam) were taken offline as a precaution. Wiz describes impact as unauthenticated code execution or process memory disclosure, and says it found the flaws partly with AI. OpenAI and Calif claim independent discovery. NCSC and FBI published response guidance.

   ler a análise desta fonte ocultar

   The patches have now been released (just before 10 am ET on October 21). Cloudflare reports early attacks emerging before release. Government and port websites in Finland, France and the Netherlands (Port of Rotterdam) were taken offline as a precaution. Wiz describes impact as unauthenticated code execution or process memory disclosure, and says it found the flaws partly with AI. OpenAI and Calif claim independent discovery. NCSC and FBI published response guidance.

   The PHP Foundation released fixes just before 10 am ET on October 21 for two critical flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 each). The flaws affect all PHP installations serving web requests, going back to PHP 5. Cloudflare reported "early attacks emerging" before the patches were published, and Sansec expected mass exploitation within 15 minutes of release. Ahead of the release, some organizations took sites offline as a precaution, including multiple Finnish government sites (the National Land Survey), French government sites and the Port of Rotterdam. Wiz says it found the flaws partly with AI tools, while OpenAI and Calif claim independent discovery. Only PHP 8.2 and newer receive patches, and the PHP Foundation states there are no complete mitigations.

   Technical Details

   • Per Wiz, unauthenticated attackers can execute code on affected servers or read sensitive process memory (passwords, tokens, API keys, certificates). Wiz calls its demonstration php2shell and says exploitation can be "fairly easy" in some cases.
   • Consultant Davi Ottenheimer describes the bug as sitting in a file upload interface, where a single crafted upload to any reachable server is the entire attack.
   • Experts warn of potential wormable malware. Details reportedly leaked before the official publication (BleepingComputer, Ars Technica).
   • Software built on PHP, such as WordPress, Drupal and Magento, is exposed. Legacy PHP versions remain unpatched unless a distribution or vendor backports fixes.

   Remediation

   • Update PHP immediately. The PHP Foundation says updating is the only safe choice.
   • The NCSC advises identifying all PHP systems, prioritizing internet-facing ones, monitoring them for exploitation, and watching for vendor updates to software that embeds PHP. Where immediate patching is not feasible, consider taking the system offline.
   • The FBI (Brett Leatherman) advises isolating compromised systems, preserving web server and PHP logs, and reporting to the local FBI field office.
7. elastic.co ↗ · pub. 20/10/2026 21:00 · coletado 21/10 12:01

   php2shell: Elastic detection coverage for PHP core RCE flaws CVE-2026-109618 and CVE-2026-109619 after pre-disclosure leak

   Elastic Security Labs adds the PHP security team's published root causes (OOM corruption and stale global state), the fixed versions (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35), the fix commit, the only partial php.ini mitigations, and the fact that watchTowr reproduced CVE-2026-109618 without observing in-the-wild exploitation. It also adds a behavioral detection strategy with named Elastic EDR and SIEM rules and PHP inventory queries, plus additional ATT&CK mappings (T1059, T1505.003).

   ler a análise desta fonte ocultar

   Elastic Security Labs adds the PHP security team's published root causes (OOM corruption and stale global state), the fixed versions (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35), the fix commit, the only partial php.ini mitigations, and the fact that watchTowr reproduced CVE-2026-109618 without observing in-the-wild exploitation. It also adds a behavioral detection strategy with named Elastic EDR and SIEM rules and PHP inventory queries, plus additional ATT&CK mappings (T1059, T1505.003).

   On October 20, 2026, details of two unauthenticated PHP core remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (nicknamed php2shell), leaked ahead of coordinated disclosure. The PHP security team rated both critical (CVSS v4.0 9.2) and moved the emergency release to October 21, 2026 at 14:00 UTC. Wiz Research reported the flaws, and watchTowr reproduced CVE-2026-109618 but had not observed in-the-wild exploitation. Elastic argues that, with no reliable public PoC, defenders should detect the convergent post-exploitation behavior: a web server or PHP worker process spawning a shell, downloading payloads or dropping webshells.

   Technical Details

   • CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is partially initialized, and request cleanup then treats the invalid data as valid.
   • CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state survives after its backing memory is freed, and a later request handled by the same worker may use the stale state before initialization resets it.
   • Both are reachable by an unauthenticated web request. Affected runtimes include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed; mod_php is flagged as highest risk because the issue can trigger before any application code runs.
   • Fix commit: 31c0ea7d7ff1d1fccb6492e52dab544011628065.
   • Mapped techniques: Exploit Public-Facing Application (T1190), Command and Scripting Interpreter (T1059) and Web Shell (T1505.003).
   • Expected post-exploitation flow: identity checks (id, whoami), privilege escalation enumeration (sudo -l, SUID search), interpreter staging (python -c, perl -e, php -r), curl/wget payload retrieval, inline base64 decoding, reverse shells, credential and cloud metadata harvesting (.env, ~/.aws/credentials, 169.254.169.254), webshell drops (.php/.phtml, double extensions) and persistence via cron, systemd or authorized_keys.
   • Elastic rules cited. EDR: Payload Execution by Web Server, Payload Downloaded via Curl or Wget by Web Server, Suspicious Web Server Child Process. SIEM: Suspicious/Unusual Command Execution via Web Server, Suspicious/Unusual Child Execution via Web Server, Unusual File Creation via/by Web Server, File with High Entropy Created by Web Server (requires Elastic Stack 9.3.0+), Web Shell Detection: Script Process Child of Common Web Processes.
   • Elastic notes coverage gaps are possible, for example account creation or fileless PHP script execution. It also provides Kibana and Osquery queries to inventory PHP installs on Linux and Windows.

   Remediation

   • Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, internet-facing systems first, and check distributions and hosting providers for backported packages.
   • PHP 8.1 and older are end of life (minimal source backports exist for 7.4, 8.0 and 8.1); upgrade, remove from the internet, or place behind a VPN or WAF.
   • The PHP team states there are no complete mitigations. Temporary exposure reduction only: memory_limit=-1 set non-overridably with a container/cgroup limit, a low post_max_size, session.upload_progress.enabled=0 with a restart of all workers, and fatal_error_backtraces=0 on PHP 8.5. Set these via php.ini, the FPM pool or server config; ini_set() and .user.ini do not help.
   • Enable the listed Elastic SIEM rules and Elastic Defend with prevention on PHP and web server hosts.
   • If compromise is suspected, isolate the host, preserve web server and PHP logs, and hunt for webshells, new web-root files, cron jobs, services and accounts.
8. blog.cloudflare.com ↗ · pub. 21/10/2026 10:56 · coletado 21/10 12:00

   php2shell: PHP memory flaws CVE-2026-109618 and CVE-2026-109619 exploited after leak; Cloudflare deploys WAF mitigations

   ler a análise desta fonte ocultar

   Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively named php2shell. They affect all web servers running PHP 5.4 or later and can allow denial of service, remote code execution and data exposure through specially crafted HTTP requests. The flaws leaked before the official disclosure date, and Cloudflare observed attack traffic against its customers, with attackers mutating payloads to evade its rules. Cloudflare worked with the PHP foundation, OpenAI and Wiz on coordinated mitigation. It deployed WAF rules from early October 2026, about 9 hours before public disclosure, and enabled them by default on all plans from 3:02 UTC on 21 October. Because PHP is used by almost 70% of websites and underpins platforms such as WordPress and Magento, the potential exposure is very large.

   Technical Details

   • Both flaws are memory-safety issues in how PHP handles errors while processing an HTTP request.
   • First flaw: PHP runs out of memory and stops before some internal data is initialized. During request cleanup it then treats that unfinished data as valid.
   • Second flaw: a fatal error leaves PHP holding references to memory that is freed when the request ends. A later request handled by the same PHP process may follow those stale references (use-after-free) and expose sensitive data.
   • By manipulating the data in this invalid memory, an attacker may crash a PHP process, leak information or execute attacker-supplied code. Large requests can create the memory pressure, but the impact goes beyond resource exhaustion.
   • The flaws are in the PHP runtime itself, so updating site code or plugins does not fix them.
   • Cloudflare built a new WAF capability, full transaction detection, which combines request and response signals within the same HTTP transaction and can block a matching origin response before it reaches the requester. The php2shell rules are its first managed detections.
   • New rules are in the Cloudflare Managed Free Ruleset (ID 77454fe2d30c4220b5701f6fdfb893ba), the Cloudflare Managed Ruleset (ID efb7b8c949ac4650a09736fc376e9aee) and the Managed Response Firewall Default (default block for high-confidence signatures).

   Remediation

   • Update PHP to the fixed version per the PHP advisory. If a hosting provider manages PHP, ask it to apply the security update.
   • Keep WAF protections enabled while patching. Paid-plan customers (Professional, Business, Enterprise) should confirm the Managed Ruleset is deployed in block mode.
   • Restricting unnecessary uploads and limiting upload sizes can reduce exposure but does not replace the patch.
   • Review blocked requests in Security > Security Analytics > Events, filtering by the rule IDs.
9. blog.checkpoint.com ↗ · pub. 21/10/2026 10:46 · coletado 21/10 12:00

   Leaked 'php2shell' critical PHP core RCE flaws CVE-2026-109618 and CVE-2026-109619 await out-of-cycle patch

   Check Point's blog adds a defender-oriented view from before the patch release: the PHP advance notice (19:33 UTC) moved the release a day earlier, to October 21 at 14:00 UTC. It adds a confidence-graded breakdown of what PHP confirmed versus what comes from researchers, no exploitation yet and no KEV listing, and a hunting checklist. It also gives Check Point mitigations, including keeping CPAI-2021-0286 in Prevent mode and a temporary WAF block on multipart/form-data POSTs.

   ler a análise desta fonte ocultar

   Check Point's blog adds a defender-oriented view from before the patch release: the PHP advance notice (19:33 UTC) moved the release a day earlier, to October 21 at 14:00 UTC. It adds a confidence-graded breakdown of what PHP confirmed versus what comes from researchers, no exploitation yet and no KEV listing, and a hunting checklist. It also gives Check Point mitigations, including keeping CPAI-2021-0286 in Prevent mode and a temporary WAF block on multipart/form-data POSTs.

   A Hacker News post on October 20 leaked two critical remote code execution (RCE) vulnerabilities in the PHP core interpreter, CVE-2026-109618 and CVE-2026-109619, dubbed php2shell by researchers. watchTowr confirmed the leak was genuine and reported reproducing CVE-2026-109618. The PHP security team announced an out-of-cycle release for both flaws, each rated CVSS v4.0 9.2 (the leak claimed 10.0), scheduled for October 21 at 14:00 UTC, with no workaround offered. No in-the-wild exploitation has been reported and neither CVE is in CISA's KEV catalog. Check Point warns that the patch diff will let attackers build exploits quickly and advises treating the next 72 hours as incident readiness.

   Technical Details

   • Only three facts come from PHP itself: two critical flaws, CVSS 9.2 each, and the release time. The CVE IDs and the php2shell name come from researchers and the leak.
   • Type (high confidence): RCE in the PHP core interpreter, so updating WordPress, Magento or Drupal alone will not fix it.
   • Authentication (medium confidence): likely none required, as inferred by CERT-EU from the score.
   • Affected versions (medium confidence): reportedly every version from PHP 5 onward (Sansec says 5.4+). PHP has not confirmed the range.
   • Fixes: only the supported branches 8.2, 8.3, 8.4 and 8.5 will be patched. PHP 8.1 and older stay exposed unless a distribution or vendor backports the fix.
   • Attack vector (low confidence): crafted multipart/form-data POST requests that reach PHP before any application script runs. One report describes CVE-2026-109618 as a use-after-free.
   • Screenshots of an exploit tool called PHP2Shell, claiming to work against PHP 5.4.0 and later, are circulating.
   • Mallory counted about 884,000 internet-facing hosts advertising PHP 8.1 or older in Shodan banners on October 20 (about 59% of ~1.5M hosts reporting a version), plus ~740,000 reporting PHP with no version. These are banner counts, not confirmed vulnerable systems.
   • The last comparable core PHP RCE, CVE-2024-4577, drew botnet scanning within about 24 hours of disclosure.
   • Hunting: unusual multipart POSTs, PHP worker crashes or segfaults, web server processes (php-fpm, httpd, www-data) spawning sh, bash, curl, wget, python or nc, new .php files in webroots, and new outbound traffic after inbound POSTs.

   Remediation

   • Inventory every PHP instance, internet-facing first. Include PHP-FPM pools, container images, vendor appliances, Windows software bundling php.exe or php-cgi.exe, and cPanel, Plesk and CMS platforms.
   • Stage the update path and book a change window for 14:00 UTC. At release, confirm versions against the php.net advisory, patch internet-facing hosts first, restart PHP-FPM or the web server, and verify the running version.
   • Plan for end-of-life PHP (8.1 and older): vendor backport, upgrade, or isolation behind a VPN or WAF. Track Ubuntu, Debian, Red Hat, SUSE and Alpine advisories.
   • Per CERT-EU, take internet-facing PHP applications offline or behind access control until patched.
   • Check Point: set IPS to Prevent and watch for a new CPAI entry. Keep CPAI-2021-0286 (PHP Webshell Upload Over HTTP) in Prevent mode. Temporarily block multipart/form-data POSTs on paths that do not accept uploads (this will break upload forms). Restrict outbound traffic from web servers.
   • Repeat hunting after the release, then again at 24 and 72 hours. If suspicious activity is found, isolate the server, preserve logs, and hunt for webshells, new cron jobs or scheduled tasks, and new accounts.
10. unit42.paloaltonetworks.com ↗ · pub. 21/10/2026 10:40 · coletado 21/10 12:00

    Unit 42 warns of PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 with PoC seen and 22.6M exposed instances

    Unit 42 adds that it has seen proof-of-concept code, that at least one European government took its website offline as a precaution, and that Cortex Xpanse telemetry shows over 22.6 million potentially vulnerable exposed instances (far above the 5.1 million PHP hosts estimated by VirusTotal). It also reports a Palo Alto Networks virtual patching signature (543004) available since October 20, 2026.

    ler a análise desta fonte ocultar

    Unit 42 adds that it has seen proof-of-concept code, that at least one European government took its website offline as a precaution, and that Cortex Xpanse telemetry shows over 22.6 million potentially vulnerable exposed instances (far above the 5.1 million PHP hosts estimated by VirusTotal). It also reports a Palo Alto Networks virtual patching signature (543004) available since October 20, 2026.

    Unit 42 published a threat brief on two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CVSS 4.0). Unit 42 has seen proof-of-concept code for the vulnerabilities, and at least one European government took its website offline as a precaution. Palo Alto Networks Cortex Xpanse telemetry identified over 22.6 million internet-exposed instances potentially vulnerable. Unit 42 urges defenders to assess exposure and patch immediately, following the PHP Group security advisory.

    Technical Details

    • CVE-2026-109618: out-of-memory (OOM) errors handled via longjmp() leave request memory uninitialized because of improper control flow management. Attackers can reliably achieve RCE by triggering OOM conditions.
    • CVE-2026-109619: longjmp() fatal error handling leaves global memory pointing to freed regions. These regions can be read or branched on during later requests, enabling arbitrary code execution.
    • Palo Alto Networks protections: Advanced Threat Prevention Plus with Frontier Virtual Patching (Threat Prevention signature 543004, available since October 20, 2026) on Next-Generation Firewall.
    • Cortex XDR, Cloud Runtime and XSIAM help against post-exploitation activity. Cortex Cloud Posture and Prisma Cloud Compute detect vulnerable PHP versions. Cortex Xpanse surfaces exposed assets through the PHP Attack Surface Rule.

    Remediation

    • Review the PHP Group security advisory and apply the patches immediately.
    • Assess internet-facing PHP exposure, for example with the Cortex Xpanse PHP Attack Surface Rule.
    • Enable the Threat Prevention signature 543004 where applicable.
11. bleepingcomputer.com ↗ · pub. 21/10/2026 11:07 · coletado 21/10 12:00

    PHP releases emergency patches for critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)

    The emergency release is now out. Fixed versions are confirmed as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports for PHP 7.4, 8.0 and 8.1. Cloudflare reports early attacks already observed in the wild, and the UK NCSC advised immediate patching or taking systems offline. The PHP team also published partial mitigations. The researchers who discovered the flaws are credited as Calif, Wiz and OpenAI. The article also confirms mod_php as the highest-risk configuration.

    ler a análise desta fonte ocultar

    The emergency release is now out. Fixed versions are confirmed as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports for PHP 7.4, 8.0 and 8.1. Cloudflare reports early attacks already observed in the wild, and the UK NCSC advised immediate patching or taking systems offline. The PHP team also published partial mitigations. The researchers who discovered the flaws are credited as Calif, Wiz and OpenAI. The article also confirms mod_php as the highest-risk configuration.

    The PHP security team released emergency patches for two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, tracked collectively as PHP2Shell. The flaws were found by researchers at Calif, Wiz and OpenAI and affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for mod_php, where a demonstrated exploit triggers the attack before any application code runs. Cloudflare CTO Dane Knecht said the company was already seeing early attacks against the two vulnerabilities before the patches shipped, and the UK NCSC told organizations to update immediately or take PHP systems offline. VirusTotal estimates over 5.1 million PHP hosts are exposed online.

    Technical Details

    • Both flaws stem from PHP leaving its memory in a corrupted state when a request ends abnormally.
    • CVE-2026-109618 allows RCE as the web worker account through a chain of weaknesses that trigger out-of-memory corruption.
    • CVE-2026-109619 is a stale global state bug that enables an unauthenticated heap use-after-free, memory disclosure and RCE with the web worker's privileges.
    • PHP core developer Gina Peter Banyard warned that no mitigation fully blocks attacks and that patching is the only permanent defense.
    • Cloudflare deployed temporary WAF rules against known exploitation methods.

    Remediation

    • Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on PHP 8.x servers. Migrate PHP 7 or earlier to a fixed release.
    • PHP 8.1 and older are no longer supported. Ask the distribution or LTS vendor for backported fixes. The PHP team also provided minimal source backports for PHP 7.4, 8.0 and 8.1.
    • Partial mitigations for CVE-2026-109618: set memory_limit=-1 in a way applications cannot override (e.g. php_admin_value), set a low post_max_size (8M, or 32M if uploads are needed), and use container or cgroup limits that kill only the affected worker.
    • Partial mitigations for CVE-2026-109619: set session.upload_progress.enabled=0 and restart all workers. On PHP 8.5, set fatal_error_backtraces=0. Remove settings that emit diagnostics before initialization. Fix attacker-reachable fatal errors and execution timeouts.
12. olhardigital.com.br ↗ · pub. 21/10/2026 09:31 · coletado 21/10 10:01

    Two critical PHP RCE flaws (CVSS 9.2) affecting versions since PHP 5; Cloudflare sees early exploitation ahead of patch

    ler a análise desta fonte ocultar

    Two critical remote code execution (RCE) vulnerabilities in PHP, rated 9.2/10 and reportedly affecting versions as far back as PHP 5, are expected to be fixed in a security release scheduled for 11:00 (Brasília time) on 21 October 2026. watchTowr describes the flaws as allowing attackers to run commands on affected servers, alter pages and steal data. Cloudflare says it is already seeing the first exploitation attempts, and Sansec expects mass attacks within minutes of the patch being published. One researcher estimates more than 1.3 million internet-facing servers may be vulnerable, and Wordfence says all WordPress sites are exposed because they depend on PHP.

    Technical Details

    • The article gives no CVE identifiers or technical root cause; the flaws are described as enabling unauthenticated-style remote code execution on servers running PHP, with a 9.2/10 severity rating.
    • The fix cannot be delivered through WordPress automatic updates. It must be applied to the PHP runtime, so hosting providers or server administrators must perform the update.
    • The PHP developers may release the patch early if details become public or active exploitation is evident.
    • GrapheneOS took its discussion forum offline while proof-of-concept exploits were being developed.
    • Cloudflare is temporarily adjusting its firewall rules to block early attacks, which is a stopgap only.

    Remediation

    • Install the PHP security update as soon as it is released. PHP developer Gina Peter Banyard states the patch is the only real mitigation.
    • Check whether your hosting provider has published guidance or applied the fix.
    • Restrict administrative access to servers and exposed applications.
    • Follow official PHP developer announcements.
    • If patching is not possible, EU and UK cybersecurity authorities recommend isolating internet-facing applications or taking them offline temporarily; Banyard says shutting servers down "may be the most sensible decision".
13. securityaffairs.com ↗ · pub. 21/10/2026 07:13 · coletado 21/10 10:00

    PHP schedules emergency release for php2shell flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 RCE) after details leaked

    Adds PHP's official advance notice (release October 21 at 14:00 UTC, no workaround, details withheld), a researcher claim that the bugs are heap use-after-free issues in the session.upload_progress handler, predicted fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), Mallory's Shodan exposure estimate (about 884,000 hosts on PHP 8.1 or older), Huntress's statement that it has seen no exploitation, and detection and hunting guidance.

    ler a análise desta fonte ocultar

    Adds PHP's official advance notice (release October 21 at 14:00 UTC, no workaround, details withheld), a researcher claim that the bugs are heap use-after-free issues in the session.upload_progress handler, predicted fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), Mallory's Shodan exposure estimate (about 884,000 hosts on PHP 8.1 or older), Huntress's statement that it has seen no exploitation, and detection and hunting guidance.

    The PHP security team announced an emergency security release for October 21, 2026 at 14:00 UTC, one day earlier than the leaked disclosure date. It addresses two critical flaws, CVE-2026-109618 and CVE-2026-109619 (dubbed php2shell), both rated CVSS v4.0 9.2. Leaked reports cited CVSS 10.0 and an impact reaching back to PHP 5, but PHP has not yet published technical details, affected versions or fixed versions. watchTowr confirmed the flaws are real and reproduced CVE-2026-109618 without releasing details. Huntress and watchTowr report no observed exploitation and no vendor patch at the time of writing. Mallory estimates about 884,000 internet-facing hosts report PHP 8.1 or older, which may not receive an upstream fix.

    Technical Details

    • A researcher post on X claims both flaws are heap use-after-free primitives in PHP's session.upload_progress handler (php_session_rfc1867_callback, ext/session/session.c). This is unverified and comes from outside the PHP project.
    • The RCE claim and the CVE identifiers come from reports outside PHP's advisory. The claim that all versions from PHP 5 onward are affected is not confirmed by any vendor advisory, and no configuration requirement has been described.
    • PHP currently supports branches 8.2 to 8.5. Mallory predicts the fixed versions will be PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These are predictions, not confirmed.
    • Mallory's Shodan data from October 20 shows about 1.5 million hosts disclosing a PHP version in HTTP banners, of which about 884,000 (roughly 59%) run PHP 8.1 or older. Another 740,000 hosts report PHP without a version. These counts are hosts, not sites or organizations, and do not prove vulnerability.
    • Precedent: after CVE-2024-4577 became public in June 2024, Akamai saw exploit attempts against its honeypots within 24 hours.
    • Suggested detection: on Linux, investigate php-fpm, php-cgi, httpd or apache2 spawning sh, bash, python, curl or wget. Florian Roth's open-source process-watcher can log these launches but does not block them.

    Remediation

    • Inventory all PHP deployments, including web servers, Windows hosts, vendor appliances, hosting panels (cPanel, Plesk) and applications bundling their own PHP runtime. Prioritize internet-facing and business-critical systems.
    • Patch as soon as fixed releases are published. Check with the Linux distribution and hosting provider, since fixes may be backported without changing the upstream version number.
    • Organizations running end-of-life PHP (8.1, 8.0, 7.x, 5.x) should upgrade to a supported branch, apply OS-vendor fixes, or reduce exposure via VPN or IP allowlisting, a WAF, or taking services offline.
    • CERT-EU advises isolating internet-facing applications from public networks if immediate patching is not feasible. This is a precaution, not a confirmed workaround.
    • If suspicious activity is found, isolate the server, preserve PHP and web server logs, and check web roots for new files and webshells, plus unexpected cron jobs, scheduled tasks and user accounts.
14. gbhackers.com ↗ · pub. 21/10/2026 09:02 · coletado 21/10 10:00

    Cloudflare reports early exploitation attempts against two critical unpatched PHP flaws; emergency WAF rules deployed

    ler a análise desta fonte ocultar

    Cloudflare warned that attackers are already attempting to exploit two critical PHP vulnerabilities ahead of an official fix. The PHP Foundation rated both flaws CVSS v4 9.2 and scheduled a security release for 21 October 2026 at 14:00 UTC. Cloudflare CTO Dane Knecht said emergency WAF rules covering known exploit vectors are live for all customers, including the free tier, and are being updated as new vectors appear. The article does not report attack volumes, targets, successful compromises, or whether working exploit code is public, so exploitation attempts should not be read as confirmed compromises.

    Technical Details

    • The article gives no CVE identifiers, affected version ranges, patched release numbers, vulnerability classes or exploitation prerequisites.
    • Claims of RCE or authentication bypass are unsupported by the source.
    • The headline says the flaws were "leaked", but the article does not say what leaked, where, or whether exploit code is available.
    • Cloudflare describes the WAF rules as a "stopgap measure" covering only known vectors, so they may not block every exploitation technique.

    Remediation

    • Prepare to apply the PHP security release as soon as the PHP Foundation publishes it.
    • Do not rely on WAF filtering as a substitute for patching.
    • Keep Cloudflare WAF protections enabled for PHP sites in the meantime.
15. thehackernews.com ↗ · pub. 21/10/2026 07:36 · coletado 21/10 09:00

    PHP2Shell: Two Critical PHP RCE Flaws (CVSS 9.2) Unpatched Ahead of 14:00 UTC Fix; Upload-Progress Workaround Insufficient

    ler a análise desta fonte ocultar

    Two critical PHP flaws dubbed PHP2Shell, each rated 9.2 out of 10, are due to be fixed in a PHP release at 14:00 UTC on October 21, 2026. PHP has not said which versions or components are affected and has offered no workaround of its own. No exploitation has been reported, and the flaws were absent from CISA's KEV catalog when last checked. GMO Flatt Security first suggested disabling session.upload_progress.enabled, then retracted that, saying the setting alone is not a complete fix and that bypasses are expected. PHP core developer Gina Peter Banyard said patching is the only mitigation. Defenders should prepare to patch immediately and reduce exposure until then.

    Technical Details

    • Attribution of the flaw to Session Upload Progress is unconfirmed. An anonymous independent audit argues the bug described in that feature does not exist in released PHP, and says the circulating proof-of-concept does not fire.
    • watchTowr reproduced one of the flaws and reports no confirmed patch or workaround. Upwind still lists the setting as a mitigation, relaying another researcher's analysis.
    • The setting is INI_PERDIR (php.ini, .htaccess, .user.ini). .user.ini is only read by CGI/FastCGI, and PHP re-reads it every 300 seconds by default.
    • A short demonstration video was posted and then removed.
    • Only PHP branches 8.2 through 8.5 receive fixes. Branches 8.1, 7.x and 5.x are end-of-life.
    • Cloudflare added emergency "anomalous execution" rules, but its changelog does not name PHP or these flaws.

    Remediation

    • Prepare to patch the runtime that serves web requests (PHP-FPM, mod_php or CGI) as soon as the fix ships. Rehearse changes and line up approvals for an emergency restart.
    • Until then, take exposed PHP off the internet or put it behind a VPN, allowlists or authenticated edge access. Verify the origin is not reachable directly.
    • Limit blast radius: reduce stored data and privileges, remove stored credentials including cloud roles, and keep logs enabled and stored securely.
    • Disabling session.upload_progress.enabled is harmless where unused, but do not treat it as protection. Verify it on the serving process, not with php -i.
    • Upgrade or isolate end-of-life branches. Updating WordPress, Laravel or similar does not update the PHP runtime. On managed hosting, ask the provider about fixed builds.
    • After patching, review logs for pre-patch activity and check php.net and PHP GitHub security advisories for fixed versions and any CVE IDs.
16. infosecurity-magazine.com ↗ · pub. 21/10/2026 07:20 · coletado 21/10 08:01

    PHP2Shell: CVE-2026-109618 and CVE-2026-109619 critical PHP RCE flaws leaked before scheduled patch release

    The article identifies the source of the leak as a now-deleted Hacker News forum post by user 'petecooper' on October 20, which cited a CVSS of 10.0 and an October 22 disclosure date. It adds that the UK NCSC issued an emergency advisory alongside CERT-EU, and that the PHP security team said it may release patches earlier if details become public or exploitation appears in the wild.

    ler a análise desta fonte ocultar

    The article identifies the source of the leak as a now-deleted Hacker News forum post by user 'petecooper' on October 20, which cited a CVSS of 10.0 and an October 22 disclosure date. It adds that the UK NCSC issued an emergency advisory alongside CERT-EU, and that the PHP security team said it may release patches earlier if details become public or exploitation appears in the wild.

    Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (dubbed PHP2Shell), were leaked ahead of the coordinated disclosure and patch release planned for October 21 at 2pm GMT. A Hacker News forum user, petecooper, posted the CVE identifiers on October 20, claiming a CVSS score of 10.0 and a disclosure date of October 22. The post has since been deleted. watchTowr confirmed the identifiers were genuine and scheduled for later disclosure. The PHP security team rated the flaws CVSS 9.2 and said it reserves the right to release earlier if details become public or exploitation appears in the wild. CERT-EU and the UK NCSC issued emergency advisories urging organizations to prepare for immediate patching.

    Technical Details

    • Both flaws are described as RCE allowing server takeover, and are said to affect PHP versions dating back to PHP 5. The article gives no root cause or attack path.
    • PHP is used by about 69.7% of websites with a known server-side language (W3Techs), including CMS platforms such as WordPress, Drupal, Joomla and Magento.
    • The article warns that leaking CVE details and affected version ranges before a patch can enable attackers to reverse engineer the fix and exploit the flaws.
    • Kevin Beaumont, inferring from PHP pre-release builds, listed the likely fixed versions on Mastodon. The article text does not include the list.

    Remediation

    • Prepare for immediate patching of affected PHP assets as soon as the fixed releases are published.
    • Where immediate patching is not feasible, CERT-EU advises isolating internet-facing applications from public networks until a fix is available.
17. tenable.com ↗ · pub. 21/10/2026 06:01 · coletado 21/10 08:00

    php2shell: Critical PHP RCE Flaws CVE-2026-109618 and CVE-2026-109619 Face Early Exploitation Ahead of Emergency Patch

    Compared with the earlier Huntress advisory, this article reports that exploitation is now emerging: Cloudflare's CTO says it is seeing early attacks and has deployed WAF rules for all customers, and watchTowr believes it has reproduced CVE-2026-109618. It also adds CERT-EU advisory 2026-018, the expected fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), the Firsov/LCFR/Calif.io exploit-chain video, internet exposure estimates of 1.3 to 1.9 million hosts, the conflicting CVSS 9.2 versus 10.0 ratings, and the history of PHP flaws in CISA KEV.

    ler a análise desta fonte ocultar

    Compared with the earlier Huntress advisory, this article reports that exploitation is now emerging: Cloudflare's CTO says it is seeing early attacks and has deployed WAF rules for all customers, and watchTowr believes it has reproduced CVE-2026-109618. It also adds CERT-EU advisory 2026-018, the expected fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), the Firsov/LCFR/Calif.io exploit-chain video, internet exposure estimates of 1.3 to 1.9 million hosts, the conflicting CVSS 9.2 versus 10.0 ratings, and the history of PHP flaws in CISA KEV.

    Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (dubbed php2shell), are due to be fixed in an emergency release on 21 October 2026 at 14:00 UTC. The PHP security team rates both CVSSv4.0 9.2, though some early reports say 10.0. Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging, and watchTowr says it believes it has reproduced CVE-2026-109618. The PHP security team has published no technical details. Fixes are expected only for supported PHP 8.x branches, so end-of-life branches are likely to stay exposed. PHP runs on roughly 69.3% of websites with a known server-side language, so the exposure is large.

    Technical Details

    • Public reporting describes both flaws as RCE. No root cause, affected component or attack path has been published.
    • CERT-EU (advisory 2026-018) says all versions from PHP 5 onward could be affected. A demonstration video references PHP 5.4.0 and later.
    • The exploit chain was demonstrated in a video shared by Kirill Firsov, who credited researcher LCFR and Calif.io. watchTowr says the disclosure was originally planned under embargo for 22 October.
    • Expected fixed versions, per Kevin Beaumont: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 5.x through 8.1.x are end-of-life with no fix expected.
    • Exposure estimates: Silas Cutler puts it at over 1.3 million potentially vulnerable internet-exposed hosts. A Shodan search by Henk Poley counts over 1.9 million internet-exposed PHP hosts.
    • Code claiming to exploit the flaws is circulating, but it is unverified and may contain malware.
    • Earlier PHP flaws in the CISA KEV catalog include CVE-2024-4577 and CVE-2019-11043, both known to have been used in ransomware campaigns.

    Remediation

    • Patch to the fixed PHP releases as soon as they ship, starting with internet-facing systems. Distribution packages may backport fixes, so check vendor advisories.
    • PHP developers say patching or upgrading is the only real mitigation. INI settings such as disabling session upload progress will not help.
    • Where patching is not possible, CERT-EU recommends isolating internet-facing applications from public networks until a fix is available.
    • Cloudflare WAF rules for the known exploit vectors are available to all tiers, including free. They are a stopgap and only cover traffic routed through Cloudflare.
    • Treat public PoC code with caution. Tenable plugins 48243, 58987, 200476 and 216936 identify PHP installations and unsupported versions.
18. huntress.com ↗ · pub. 21/10/2026 01:00 · coletado 21/10 05:00

    Huntress Rapid Response: Leaked PHP RCE Flaws CVE-2026-109618 and CVE-2026-109619 (php2shell) Ahead of Patch Release

    Huntress adds defender-oriented guidance: expected post-exploitation behavior (PHP worker processes spawning shells, interpreters or download tools), an unrelated recent PHP FastCGI abuse incident, confirmation of existing Linux/Windows webshell detections, and a statement that it has no PoC and knows of no public exploit code. It also reports that a short exploitation video was briefly posted and removed, and that no IOCs have been confirmed.

    ler a análise desta fonte ocultar

    Huntress adds defender-oriented guidance: expected post-exploitation behavior (PHP worker processes spawning shells, interpreters or download tools), an unrelated recent PHP FastCGI abuse incident, confirmation of existing Linux/Windows webshell detections, and a statement that it has no PoC and knows of no public exploit code. It also reports that a short exploitation video was briefly posted and removed, and that no IOCs have been confirmed.

    Huntress published a rapid-response advisory on two leaked critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, informally named "php2shell". Both are rated CVSS v4.0 9.2 and are publicly described as remote code execution. The details leaked via a removed Hacker News post, and watchTowr confirmed they are real. The PHP security team moved the security release up to 21 October 2026 at 14:00 UTC, and reserves the right to release sooner if details become public or exploitation appears. Huntress is not aware of public exploit code or in-the-wild exploitation and has not reproduced a PoC. It expects technical details and PoCs to follow quickly once fixes ship.

    Technical Details

    • No root cause, affected component or attack path has been published. It is unknown whether the flaws are reachable via a plain web request or depend on configuration.
    • Reports point to PHP 5, 6, 7 and 8 being affected, and some researchers expect fixes only for supported PHP 8 branches. Official affected and fixed versions are due with the 21 October release.
    • Likely exploitation pattern: PHP worker processes (php-fpm, php-cgi, php-cgi.exe, httpd, apache2) spawning shells (sh, bash, cmd.exe, powershell.exe), interpreters (python, perl) or download/network tools (curl, wget, nc, certutil.exe), plus reverse shell command lines and recon commands (whoami, id, uname -a, ipconfig).
    • Huntress observed an unrelated incident the prior week in which a PHP FastCGI process repeatedly wrote a small PHP file with random marker strings to the first writable temp directory, executed it and deleted it, printing !notwrtbl! if no directory was writable.
    • A short exploitation video was briefly posted online and removed. No IOCs have been confirmed.
    • Huntress already detects web server processes spawning shells and common webshell activity on Windows and Linux, and captured a baseline of normal PHP behavior across partner endpoints for comparison after release.

    Remediation

    • Inventory all PHP installs, including bundled php.exe/php-cgi.exe in vendor appliances and Windows software, control panels (cPanel, Plesk) and CMS platforms (WordPress, Drupal, Joomla, Magento).
    • Plan the patch window for 21 October 2026 at 10:00 ET. Patch internet-facing systems first and check distributions and hosting providers for backported packages.
    • Upgrade or isolate end-of-life environments (PHP 5, 7, 8.0/8.1) behind a VPN or WAF, as they may receive no fix.
    • Alert on PHP workers launching shells, interpreters or download tools. On Linux servers without EDR, deploy Florian Roth's process-watcher in observe mode.
    • If compromise is suspected, isolate the server, preserve web server and PHP logs, and look for webshells, new web root files, cron jobs, scheduled tasks and accounts.
19. securityweek.com ↗ · pub. 21/10/2026 04:02 · coletado 21/10 05:00

    PHP2Shell: Leaked Critical PHP RCE Flaws CVE-2026-109618 and CVE-2026-109619 Face Imminent Mass Exploitation

    Adds the confirmed patch timing (21 October 2026, 14:00 UTC) and a CVSS 9.2 rating for both flaws. WatchTowr says it reproduced CVE-2026-109618, and one report suggests that flaw is a use-after-free bug. CERT-EU infers unauthenticated exploitability from the CVSS score. Sansec predicts mass exploitation within 15 minutes of the patch release, while WatchTowr and Huntress still report no in-the-wild exploitation.

    ler a análise desta fonte ocultar

    Adds the confirmed patch timing (21 October 2026, 14:00 UTC) and a CVSS 9.2 rating for both flaws. WatchTowr says it reproduced CVE-2026-109618, and one report suggests that flaw is a use-after-free bug. CERT-EU infers unauthenticated exploitability from the CVSS score. Sansec predicts mass exploitation within 15 minutes of the patch release, while WatchTowr and Huntress still report no in-the-wild exploitation.

    Details of two critical PHP vulnerabilities dubbed PHP2Shell leaked online ahead of coordinated disclosure. Both are rated CVSS 9.2 and could lead to remote code execution. PHP has scheduled patches for 21 October 2026 at 14:00 UTC and warned that it may release them earlier if technical details are published or in-the-wild exploitation appears. WatchTowr says it reproduced one flaw, and Sansec expects mass exploitation within 15 minutes of the patch release. WatchTowr and Huntress have not observed exploitation so far.

    Technical Details

    • The flaws are reportedly tracked as CVE-2026-109618 and CVE-2026-109619. CERT-EU says the CVSS scores imply exploitation without authentication.
    • Public details do not include a root cause, affected component or attack path. One report suggests CVE-2026-109618 is a use-after-free bug.
    • Public reporting suggests all PHP versions from PHP 5 onwards are affected. This is unconfirmed.
    • WatchTowr CEO Benjamin Harris confirmed the vulnerabilities are real and that the firm reproduced CVE-2026-109618, but it is withholding technical details until patches ship.
    • Sansec predicts mass exploitation will start within 15 minutes of the patch release.

    Remediation

    • Prepare to upgrade PHP as soon as the release is available, as PHP urges. Prioritize internet-facing systems.
    • Monitor for earlier out-of-cycle releases, since PHP may ship the fix ahead of schedule.
20. thehackernews.com ↗ · pub. 21/10/2026 01:57 · coletado 21/10 03:00

    PHP to ship out-of-cycle fix for two unpatched CVSS 9.2 RCE flaws ("php2shell") after embargo leak; no exploitation reported

    Adds the leak chronology (the October 20 HN post claiming CVSS 10.0 and PHP 5+ scope, confirmed as real by watchTowr), the "php2shell" nickname, and the fact that only PHP 8.2 to 8.5 will be patched while end-of-life branches get no fix. Includes Mallory's Shodan banner count of about 884,000 hosts on PHP 8.1 or older, Huntress's finding of no exploitation or public PoC, and a six-step preparation and detection checklist drawing on Huntress, CERT-EU and Florian Roth.

    ler a análise desta fonte ocultar

    Adds the leak chronology (the October 20 HN post claiming CVSS 10.0 and PHP 5+ scope, confirmed as real by watchTowr), the "php2shell" nickname, and the fact that only PHP 8.2 to 8.5 will be patched while end-of-life branches get no fix. Includes Mallory's Shodan banner count of about 884,000 hosts on PHP 8.1 or older, Huntress's finding of no exploitation or public PoC, and a six-step preparation and detection checklist drawing on Huntress, CERT-EU and Florian Roth.

    The PHP security team announced an out-of-cycle release for 14:00 UTC on October 21, 2026, fixing two vulnerabilities rated CVSS v4.0 9.2. The notice did not describe them. watchTowr says both allow remote code execution, and researchers are calling the pair php2shell, a name that is theirs, not PHP's. The notice followed an October 20 leak on HN that claimed two RCE flaws rated CVSS 10.0, affecting PHP 5 onward, would be disclosed on October 22. watchTowr confirmed the leak was real and that the flaws were under embargo. No exploitation has been reported and the flaws are not in CISA's KEV catalog. Only PHP 8.2 to 8.5 will receive fixes, so end-of-life branches could be left without a vendor patch.

    Technical Details

    • The leaked identifiers CVE-2026-109618 and CVE-2026-109619 are not named in PHP's notice. The CVSS 10.0 score and the "every version since PHP 5" scope come from the leak and are unconfirmed. PHP's own rating is 9.2 on CVSS v4.0.
    • No affected component, attack vector, authentication requirement or configuration prerequisite has been described. PHP says full details and fixed versions will be published with the release.
    • The notice says PHP may release earlier if details become public or exploitation appears in the wild.
    • Supported branches are 8.2 and 8.3 (security fixes only) and 8.4 and 8.5 (active support). PHP 8.1, 8.0, 7.x and 5.x are end of life and get no fix.
    • Mallory counted about 884,000 internet-facing hosts whose HTTP banner reported PHP 8.1 or older on October 20 (59% of roughly 1.5 million hosts reporting a version). A further 740,000 hosts reported PHP without a version. These are banner counts, not confirmed affected systems.
    • Huntress had seen no exploitation in its partner environments as of October 20 and was not aware of public exploit code or a proof of concept. By comparison, CVE-2024-4577 saw exploit attempts against Akamai honeypots within 24 hours of disclosure.

    Remediation

    • Inventory every PHP install, including PHP bundled in vendor appliances, Windows software and control panels such as cPanel and Plesk.
    • Be ready to upgrade at 14:00 UTC and patch internet-facing systems first. Check your Linux distribution and hosting provider for backported packages.
    • On end-of-life branches, upgrade, take the system off the internet, or place it behind a VPN or WAF. CERT-EU advises considering isolating internet-facing applications from public networks until a fix is available.
    • Alert on php-fpm, php-cgi, httpd or apache2 launching shells, interpreters or download tools. Florian Roth's process-watcher can log every program a PHP process starts on Linux servers without EDR, but it prevents nothing.
    • If compromise is suspected, isolate the server and preserve web server and PHP logs. Look for web shells, new files in the web root, new cron jobs, scheduled tasks and accounts.
21. gbhackers.com ↗ · pub. 21/10/2026 01:47 · coletado 21/10 02:00

    PHP maintainers pre-announce two CVSS 9.2 RCE flaws (CVE-2026-109618/109619 per watchTowr); patch due Oct 21, 2026

    This article adds watchTowr's caveats: the CVE identifiers and the 'PHP 5 onward' scope are unverified, and the two 9.2 scores are not confirmed as belonging to CVE-2026-109618 and CVE-2026-109619. It notes a conflicting rumored announcement time (October 22, 18:00 CEST) versus PHP's official October 21, 14:00 UTC. It also states that PHP may release patches early if details leak or exploitation emerges, that watchTowr saw no known exploitation as of October 21, and that teams should not rely on speculative configuration changes.

    ler a análise desta fonte ocultar

    This article adds watchTowr's caveats: the CVE identifiers and the 'PHP 5 onward' scope are unverified, and the two 9.2 scores are not confirmed as belonging to CVE-2026-109618 and CVE-2026-109619. It notes a conflicting rumored announcement time (October 22, 18:00 CEST) versus PHP's official October 21, 14:00 UTC. It also states that PHP may release patches early if details leak or exploitation emerges, that watchTowr saw no known exploitation as of October 21, and that teams should not rely on speculative configuration changes.

    The PHP security team published an advance notice on October 20, 2026 for a release at 14:00 UTC on October 21 that fixes two vulnerabilities, each rated CVSS v4.0 9.2. watchTowr reports them as two possible remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Its report is unverified, and PHP has not confirmed the identifiers, the technical details, or which CVE carries which score. watchTowr's reported scope is every PHP version from PHP 5 onward, but the maintainers have not verified this. PHP may release patches earlier if details become public or exploitation appears. As of October 21, watchTowr reported no known in-the-wild exploitation.

    Technical Details

    • Two RCE vulnerabilities, each scored 9.2 under CVSS v4.0 in the official notice. The notice does not tie the scores to named CVEs.
    • watchTowr's FAQ says the flaws could let attackers run their own code on affected PHP servers.
    • No affected components, vulnerable functions, attack vectors, authentication requirements or configuration prerequisites have been disclosed.
    • watchTowr's FAQ cites a rumored announcement on October 22 at 18:00 CEST, circulated via social media. This conflicts with PHP's official October 21, 14:00 UTC schedule.
    • No IOCs or exploitation evidence are available.

    Remediation

    • Follow the vendor's published schedule and monitor official PHP security channels. Install the confirmed fixed versions as soon as they are released.
    • Inventory production PHP installations, identify the application owners, and prepare update procedures before the release.
    • No workaround or affected-version matrix has been confirmed. Avoid relying on speculative configuration changes.
22. aikido.dev ↗ · pub. 20/10/2026 22:54 · coletado 21/10 01:00

    PHP leaked critical RCE flaws CVE-2026-109618 and CVE-2026-109619 (php2shell): patches due Oct 21, all versions treated as affected

    Aikido says that independent researchers confirmed the leaked flaws and that the release was moved up to October 21 because of the leak. It advises treating all PHP versions as affected and says it is coordinating the disclosure with the PHP Foundation. It dubs the issue "php2shell", says the vulnerabilities are still circulating, and promises workarounds and patches with the release.

    ler a análise desta fonte ocultar

    Aikido says that independent researchers confirmed the leaked flaws and that the release was moved up to October 21 because of the leak. It advises treating all PHP versions as affected and says it is coordinating the disclosure with the PHP Foundation. It dubs the issue "php2shell", says the vulnerabilities are still circulating, and promises workarounds and patches with the release.

    Aikido warns that two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP itself, and it advises treating all versions as affected. Both are rated CVSS v4.0 9.2. The PHP security team will release fixes at 14:00 UTC on October 21, 2026. Aikido is coordinating the disclosure with the PHP Foundation. The team published an advance notice on October 20 after details leaked ahead of the planned date. Independent researchers confirmed the flaws were real, so the release was moved up to October 21, and the vulnerabilities are still circulating. Aikido refers to the issue as "php2shell" and is withholding exploitation details until patches are available.

    Technical Details

    • Both flaws are remote code execution issues with a CVSS v4.0 score of 9.2.
    • Aikido says all PHP versions should be treated as affected. The article gives no specific version ranges.
    • No exploitation details, IOCs or evidence of in-the-wild exploitation are provided.
    • The article's sidebar links to unrelated supply-chain stories (tensorlake npm compromised with the Shai Hulud worm, the supplychain.local Go worm, the Graphalgo campaign). They are not analysed here.

    Remediation

    • Be ready to deploy the PHP security release as soon as it is published on October 21 at 14:00 UTC.
    • Inventory all PHP deployments in the stack, especially internet-facing ones.
    • Watch Aikido and the official PHP site for workarounds and patches.
23. bleepingcomputer.com ↗ · pub. 20/10/2026 17:56 · coletado 20/10 18:00 primeiro registro

    PHP warns of emergency patches for two leaked critical RCE flaws, CVE-2026-109618 and CVE-2026-109619

    ler a análise desta fonte ocultar

    The PHP security team has warned administrators to prepare for emergency security updates on October 21 at 14:00 UTC, fixing two critical vulnerabilities each rated 9.2 under CVSS v4.0. Information about the flaws reportedly leaked ahead of the planned embargo, and the team says it may release earlier if details become public or exploitation appears in the wild. watchTowr told BleepingComputer the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution (RCE) issues believed to affect PHP versions 5, 6, 7 and 8, and that it believes it has reproduced CVE-2026-109618. watchTowr has not observed exploitation in the wild and is withholding technical details until patches are available. The leak followed a now-deleted Hacker News post by user "petecooper" that named both CVE IDs.

    Technical Details

    • PHP has not published affected versions, exploitation details or fixed releases; these are due with the security release.
    • watchTowr and the Hacker News post describe both flaws as CVSS 10.0, while PHP's advisory rates each 9.2 (CVSS v4.0).
    • The disclosure date is also inconsistent: watchTowr and the Hacker News post cite October 22 (Thursday), while PHP has scheduled the release for October 21.
    • The affected version range (PHP 5 to 8) comes from watchTowr and is not confirmed by PHP.

    Remediation

    • Prepare to deploy the PHP security updates as soon as they are released on October 21 at 14:00 UTC, or earlier if PHP releases ahead of schedule.
    • Inventory internet-facing PHP applications (CMS, e-commerce, custom services) and identify the PHP versions in use.
    • Monitor the PHP ANNOUNCE mailing list and the official advisory for affected versions and fixed releases.

Repetiram sem novidade

• theregister.com — PHP releases emergency fixes for critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619 as exploitation begins
• cyberscoop.com — PHP ships emergency patches for critical php2shell RCE flaws CVE-2026-109618 and CVE-2026-109619 as early attacks emerge