Particle.news
Get it on Google Play
Download on the App Store
79 ARTICLES
·
4h ago

PHP Issues Emergency Fixes for Two 'PHP2Shell' Remote-Code Flaws

The patches close critical unauthenticated code-execution bugs that could let attackers run commands on internet-facing PHP servers.

A screen displays the unavailable French government website, info.gouv.fr, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, in Berlin, Germany, October 21, 2026.
Image
Image
FILE - An FBI seal is displayed on a podium before a news conference at the field office in Portland, Ore., Jan. 16, 2025. (AP Photo/Jenny Kane, File)

Overview

  • Security teams moved quickly after details leaked to publish emergency patches on Wednesday, Oct. 21, with fixed releases for supported branches shipped as 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  • The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, allow unauthenticated remote code execution by abusing PHP memory- and request-handling routines.
  • Cloudflare and other vendors reported early exploit attempts while CERTs, the FBI and national agencies urged immediate runtime updates or taking internet-facing sites offline if patches cannot be applied promptly.
  • Only updating the PHP runtime fully fixes the bugs; temporary configuration workarounds exist but are incomplete and many legacy or vendor-managed installs will need backports or vendor-supplied updates.
  • Researchers at Wiz, Calif and OpenAI helped find and validate the flaws, in part using AI-assisted analysis, which sped discovery but also highlights new risks from fast exploit development for widely used code like PHP.