PHP Emergency Update Fixes Two Critical RCE Flaws; PHP2Shell Exploit Reported
Summary
PHP announced fixes for CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2, after exploit details reportedly circulated. The article recommends updating to fixed PHP releases and addressing unsupported branches.
Key points
- The PHP team announced an emergency security release for two critical remote-code-execution flaws: CVE-2026-109618 and CVE-2026-109619.
- A leaked exploit tool called PHP2Shell is reportedly circulating, and security researchers have reportedly reproduced at least one flaw before the fix.
- The article says PHP installations serving web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
- Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; the PHP team also released minimal source backports for PHP 7.4, 8.0, and 8.1.
- The article reports that older, unsupported PHP branches remain common in its scans, including more than 2 million observed PHP 7.4 instances.
- The advisories reportedly offer no generic configuration workaround; applying updates is the only complete mitigation.
- Organizations are advised to inventory PHP across hosts, containers, and vendors, update promptly, and plan migration or other safeguards for unsupported branches.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- Critical; CVSS v4.0 9.2 for each vulnerability
- Affected Versions
- PHP 8.2
- PHP 8.3
- PHP 8.4
- PHP 8.5
- PHP 7.4
- PHP 8.0
- PHP 8.1
- Exploitation Status
- reported
- Exploit Availability
- claimed_or_private
- Patch Status
- available
CVE
CVE-2026-109618addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both bugs are described as remote code execution issues, meaning an attackerCVE-2026-109619vulnerabilities, both rated CVSS v4.0 9.2. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both bugs are described as remote code execution issues, meaning an attacker could get their own
Vendors
Products
Apache with mod_phpAffected products The PHP team has indicated that all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are impacted.Bitsight BeaconSupply chain exposure management: Bitsight Beacon watches critical vendors more closely, covering exposure before an incident, active intrusion and evidence left after a compromise. Validated, enriched alerts withBitsight Continuous MonitoringExternal exposure detection: Bitsight Continuous Monitoring draws on externally observable data to help spot and prioritize vendors with relevant exposure, support outreach on critical vulnerabilities, and followFrankenPHPAffected products The PHP team has indicated that all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are impacted.LiteSpeedAffected products The PHP team has indicated that all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are impacted.PHPThe PHP security team has announced an emergency security release for Wednesday, October 21, 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. The vulnerabilities are tracked asPHP-CGIAffected products The PHP team has indicated that all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are impacted.PHP-FPMAffected products The PHP team has indicated that all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are impacted.