breaking / Cybersecurity

🚨 PHP Just Shipped Emergency Fixes for Two 9.2-Rated Flaws — and Attacks Have Already Started

PHP shipped emergency fixes for two 9.2-rated flaws that let attackers run code on web servers without logging in. Attacks have already begun.

By Tech Arcade··2 min read

PHP Just Shipped Emergency Fixes for Two 9.2-Rated Flaws — and Attacks Have Already Started — Tech Arcade
Photo: Brecht Corbeel / Unsplash

PHP, the language behind 69.3% of websites whose server-side code is known (Tenable), just released emergency patches for two critical flaws that let an attacker run code on your web server without logging in (PHP.net).

Both bugs are rated 9.2 out of 10 (CVSS v4.0). The fixes landed on Wednesday, 21 October, on a schedule the PHP team had pulled forward a day after details leaked online (CyberScoop).

And the clock started early: Cloudflare says it is already “seeing early attacks emerging” (CyberScoop).

⚡ What Happened

Researchers have nicknamed the pair “PHP2Shell”. They are tracked as CVE-2026-109618 and CVE-2026-109619 (PHP.net).

  • CVE-2026-109618: when PHP runs out of memory mid-request, its clean-up code can treat half-built data as valid.
  • CVE-2026-109619: leftover state from one request can survive after its memory is freed, and the next request on the same worker can trip over it.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Every setup that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates mod_php the riskiest: a demonstrated exploit fires from a single unauthenticated request before any of your app’s code even runs (PHP.net).

BleepingComputer credits researchers at Calif, Wiz and OpenAI with finding the flaws (BleepingComputer).

🧠 Why It Matters

“The PHP situation will lead to a mass of incidents – it’s one of the biggest vulns in years.” — Kevin Beaumont, security researcher (Help Net Security)

Estimates of exposed machines vary widely, from about 1.3 million potentially vulnerable hosts (Tenable) to over 5.1 million PHP hosts online, per VirusTotal (BleepingComputer).

The bigger worry is the old stuff. PHP 8.1 and older get no official updates, only minimal source backports for 7.4, 8.0 and 8.1 (PHP.net). The UK’s National Cyber Security Centre is telling organisations to consider taking offline anything they can’t patch right away (Help Net Security).

PHP is blunt about workarounds: “There are no complete mitigations, updating is the only safe choice.” Cloudflare has pushed firewall rules to all customers, free plans included, but calls them a stopgap (CyberScoop).

🔜 What To Watch

  • Your own sites. If you run WordPress or anything else on PHP, check the version today, or ask your host whether they’ve updated.
  • Copycat exploits. Exploit code is circulating but unverified, and security firms warn some of it may be laced with malware (CyberScoop).
  • The long tail. Forgotten, embedded PHP installs that never get patched are where the damage is likely to linger.

Key facts are still emerging, including how widespread exploitation already is.

Sources

❓ Quick answers

What is PHP2Shell?

PHP2Shell is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2, that allow unauthenticated remote code execution. PHP patched them on 21 October 2026 (PHP.net).

Which PHP versions fix the PHP2Shell vulnerabilities?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.1 and older get no official updates, only minimal source backports for 7.4, 8.0 and 8.1 (PHP.net).

Are the PHP2Shell flaws being exploited?

Yes. Cloudflare's CTO said on 21 October 2026 that the company was seeing early attacks, and it has deployed stopgap firewall rules for all customers (CyberScoop).