Particle.news
Get it on Google Play
Download on the App Store
87 ARTICLES
·
7h ago

PHP Releases Emergency Fixes for Two Critical 'PHP2Shell' Flaws

The vulnerabilities let attackers run code on vulnerable servers and have led governments and providers to push immediate patching or temporary takedowns.

A screen displays the unavailable French government website, info.gouv.fr, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, in Berlin, Germany, October 21, 2026.
Image
Image
FILE - An FBI seal is displayed on a podium before a news conference at the field office in Portland, Ore., Jan. 16, 2025. (AP Photo/Jenny Kane, File)

Overview

  • PHP's maintainers released emergency updates on Wednesday to address CVE-2026-109618 and CVE-2026-109619 and urged users to install the fixes for supported branches without delay.
  • Both flaws are rated 9.2 on CVSS v4.0 and allow unauthenticated remote code execution by exploiting PHP memory-handling errors that can let one request execute data from another or run arbitrary commands.
  • Details about the bugs leaked before the fixes and a purported exploit called PHP2Shell circulated, and security firms including Cloudflare and Sansec reported early attacks and deployed temporary WAF rules and mitigations.
  • The fixes published target currently supported PHP releases while older or vendor-packaged installations remain exposed and will need vendor backports or isolation when immediate updating is not possible.
  • Researchers say the bugs were found with AI assistance and responsibly disclosed to PHP maintainers, a process that highlights both the speed AI can bring to finding flaws and the urgent need for operators to inventory, patch, log and report any suspected compromises.