Particle.news
Get it on Google Play
Download on the App Store
126 ARTICLES
·
4h ago

Emergency Patches Released for Two Critical PHP Flaws

The fixes address unauthenticated remote code execution bugs that security agencies say require immediate upgrades or temporary takedowns to stop rapid exploitation.

A screen displays the unavailable French government website, info.gouv.fr, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, in Berlin, Germany, October 21, 2026.
Image
Image
FILE - An FBI seal is displayed on a podium before a news conference at the field office in Portland, Ore., Jan. 16, 2025. (AP Photo/Jenny Kane, File)

Overview

  • Researchers using advanced AI privately reported two remote code execution flaws to PHP maintainers, and the project published emergency fixes for supported branches on Wednesday, October 21.
  • Exploit details and a demonstration called “PHP2Shell” leaked before the release, and multiple security firms and Cloudflare reported early attack activity that has been met with temporary firewall rules.
  • Cybersecurity agencies in Europe, the United States, the UK and Australia urged organisations to apply the patches immediately and to take internet-facing sites offline if they cannot be quickly patched.
  • The vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can let attackers run commands and read sensitive memory on servers running PHP, which powers roughly 70% of identifiable websites and many CMS platforms.
  • Official patches cover currently supported PHP releases while older deployments need vendor backports or isolation, creating a long tail of exposed sites and raising the risk of widespread automated attacks and service disruptions.