cyber.hendryadrian.com
Vulnerability & Exploit · cyberscoop.com

PHP Releases Emergency Patches for Two Critical php2shell Vulnerabilities

· Original article ↗

Summary

PHP released fixes for two critical php2shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, after Cloudflare reported early attacks. The flaws may affect PHP versions 5 and later; organizations are urged to patch quickly.

Key points

  • PHP issued fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  • The two flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 on the CVSS v4.0 scale and described as remote-code-execution vulnerabilities.
  • Cloudflare CTO Dane Knecht said the company was seeing early attacks; Cloudflare deployed firewall rules as a stopgap.
  • CERT-EU said the flaws could affect PHP versions 5 and later. The PHP team had not yet confirmed the technical cause or full affected-version list in the article.
  • Researchers estimated more than 1.3 million internet-exposed hosts could be vulnerable; a Shodan search counted about 1.9 million.
  • CERT-EU and the UK National Cyber Security Centre advised organizations to update quickly or isolate internet-facing applications if immediate patching was not possible.
  • OpenAI and Wiz attributed discovery to AI-assisted research, and researchers warned that AI could reduce the effort needed to adapt complex exploits.

Article Details

Vulnerability Types
  • Remote code execution
  • Memory safety
Severity
Critical; both vulnerabilities rated 9.2 on the CVSS v4.0 scale.
Affected Versions
  • PHP versions 5 and later (CERT-EU said the flaws could affect these versions; the PHP team had not officially confirmed the full affected-version list)
Exploitation Status
active
Exploit Availability
claimed_or_private
Patch Status
available
Workarounds
  • Isolate internet-facing applications where immediate patching is not feasible.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe article reports early attacks involving PHP vulnerabilities that permit remote code execution on internet-facing systems.

CVE

CVE-2026-109618EDT Wednesday, addresses two flaws catalogued as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 severity scale, which tops out at 10.CVE-2026-109619EDT Wednesday, addresses two flaws catalogued as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 severity scale, which tops out at 10.

People

Dane KnechtCloudflare CTO who said the company was seeing early attacks and updating its defenses.Kirill FirsovShared an online video demonstrating an exploit chain and credited LCFR and Calif.io.Nir OhfeldWiz researcher who discussed how AI could reduce the effort needed to develop and adapt complex exploits.Sagi TzadikWiz researcher who discussed how AI could reduce the effort needed to develop and adapt complex exploits.Shir TamariWiz researcher who discussed how AI could reduce the effort needed to develop and adapt complex exploits.Tomer SchwartzWiz researcher who discussed how AI could reduce the effort needed to develop and adapt complex exploits.

Vendors

CloudflareDane Knecht, chief technology officer at Cloudflare, said Wednesday the company was “seeing early attacks emerging” and updating its defenses as new vectors appeared.OpenAIThe vulnerability was discovered by AI cybersecurity firm Calif, using OpenAI’s cybersecurity-focused AI model GPT-5.6 Sol.WizWiz, an AI security firm purchased by Google in March, also independently discovered and reported the flaw, according to a blog posted by OpenAI on Wednesday.

Products

PHPThe PHP project is preparing an unscheduled security release for Wednesday to fix two vulnerabilities it rates as critical after details of the flaws leaked online and a major internet infrastructure company reported

Tools

Gemini 4 Argonin PHP, all related to memory safety using GPT-5.6 Sol, their own Wiz Atlas AI tool and Google’s Gemini 4 Argon to conduct their research.OpenAI GPT 5.6 SolThe vulnerability was discovered by AI cybersecurity firm Calif, using OpenAI’s cybersecurity-focused AI model GPT-5.6 Sol.Wiz Atlas AI“multiple critical vulnerabilities” in PHP, all related to memory safety using GPT-5.6 Sol, their own Wiz Atlas AI tool and Google’s Gemini 4 Argon to conduct their research.

Related Articles