📣 Announcing the immediate availability of:

- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12

‼️ These address the following critical security issues:

- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

Zwei kritische PHP-Lücken (CVE-2026-109618/109619, CVSS 9,2) ermöglichen unter bestimmten Bedingungen die Ausführung von Schadcode auf Webservern.

Dringend patchen! Für PHP 8.4 ist Version 8.4.27 erforderlich. Unter Debian 13 sind die Updates bereits verfügbar:

apt update && apt upgrade

Anschließend PHP-FPM neu starten:

systemctl restart php8.4-fpm

Auch andere Distributionen sollten jetzt aktualisiert werden!

https://www.php.net/archive/2026.php

#PHP #ITSecurity

Massive thanks to Ondřej Surý for spinning out vast php builds in a big hurry.

@deb seems to be quiet here, but the hours are definitely getting put in elsewhere. [ @ondrej !]

#php
#sury
#cve2026109618
#cve2026109619

Graphic is a paraphrase of XKCD, from https://codeberg.org/oerdnj/deb.sury.org/issues/145

PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.

If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.

Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

Jesus Christ patch your shit now

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-109618/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.

Here is what you need to know:

* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 

* The root is a decades-old design choice in PHP's error handling (described more in our post)

* There was evidence of in-the-wild exploitation pre-disclosure. 

The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application

We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.

What to do right now:

The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.

Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012. 

The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours. 

Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.

Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.

Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com

Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618

Kritische PHP-Sicherheitslücken (CVE-2026-109618/-109619)

Unser gesamtes Team arbeitet an der Betroffenheitsanalyse der bekannt gewordenen Schwachstellen und bereitet das Einspielen des PHP-Patches vor, der heute um 16 Uhr erscheinen soll.

Aufgrund der Wartungsarbeiten kann es zu Unterbrechungen kommen. Wir bitten um Ihr Verständnis.

Betreiben Sie eigene Systeme mit PHP? Führen Sie heute dringend das Update auf die neue Version durch.

Wir halten Sie auf dem Laufenden.

Notable PHP Enjoyer Palo Alto has posted their advisory on #PHP2Shell:

https://security.paloaltonetworks.com/CVE-2026-109618

ALL versions of Panorama and PAN-OS are affected. There's a fix coming, but right now I recommend shutting down anything exposed publicly, like VPN portals.

Must-read blog post from the PHP foundation:

> [ In 2024 ] a PHP core developer contracted by the PHP Foundation found the first signs of the [out-of-memory] OOM problem behind CVE-2026-109618.

> the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#php2shell

Fixes for PHP CVE-2026-109618 and CVE-2026-109619 have either landed or are on their way.

Fixed versions:

- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35

Check https://build.alpinelinux.org for the current status of each builder, and https://pkgs.alpinelinux.org to see what is present in each repository.

https://pkgs.alpinelinux.org/packages?name=php%253F%253F&branch=v3.24 for example shows the current version of PHP on the v3.24 branch.

Critical PHP security vulnerabilities (CVE-2026-109618/-109619)

Our entire team is working on assessing the impact of the disclosed vulnerabilities and preparing to deploy the PHP patch, which is due to be released today at 4 pm.

Due to maintenance work, there may be some service interruptions. We apologise for any inconvenience caused.

Do you run your own systems using PHP? Please carry out the update to the new version as a matter of urgency today.

We will keep you informed.

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

#php2shell landed:

https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Wheeeeeeeee!

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

⚠️PHP2Shell: Kritische PHP-Lücken CVE-2026-109618/109619⚠️

Zwei kritische PHP-Sicherheitslücken („PHP2Shell“) wurden am 20. Oktober vor Ablauf der Sperrfrist öffentlich. Das PHP-Team hat die Patch-Veröffentlichung für (16:00MEZ) vorgesehen.

Betroffen ist praktisch jede PHP-Website: #WordPress, #WooCommerce, #Drupal, #Joomla, #Magento. Das geleakte Exploit-Tool nennt PHP ab 5.4.0; offizielle Fixes unterstüzen nur PHP 8.2 bis 8.5 .

#php #php2shell #kritischelücke #sicherheit

Palo finally published an advisory:

https://security.paloaltonetworks.com/CVE-2026-109618

No patch but some customers can get detections. Thanks, Palo. Fucking worthless fucks.

Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.

After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) will release standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), on Oct 21st.

The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.

PHP2Shell: mitigating with CRS and AppArmor before the patch

https://blog.frehi.be/2026/10/21/php2shell-mitigating-with-crs-and-apparmor-before-the-patch/

Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.

On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.

PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.

Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.

Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.

Go patch your #php. Now.

https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/

Hade tänkt ha en lugn onsdag med höstpromenad, gotta ned sig i programmeringsproblem och galamiddag på kvällen. Och så...

CVE-2026-109618 / -109619!!!

Matrix über die PHP-Releases:

https://ma.ttias.be/php-cve-2026-109618-patch/#package-status

#nextcloud #php

Okay ( and thanks @gizmomathboy ) nice, nice, now we're talking.

Local-only exploit tester.

So now I just have to decide whether to trust… running PHP code on my server… written by an unknown third party… whose github is overflowing with AI slop.

https://github.com/slabbdev/php2shell-cve-2026-109618-109619

…oh. Hm. Maybe I didn't think through the implications of trawling the internet looking for vulnerability exploits to run on my server

📰 The PHP development team has released emergency security updates for two critical flaws that can allow unauthenticated remote code execution on affected web servers....

📡 Read full story here 👇

https://ctcnews.ca/2026/10/21/php-vulnerability-critical-php-flaws-patched-cve-2026-109618/

For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/15

#pfSense

Two critical vulnerabilities in PHP, nicknamed php2shell, were disclosed by PHP today: CVE-2026-109618 and CVE-2026-109619.

AlmaLinux 8, 9, and 10 all ship affected PHP versions, and we will release patched packages for testing today.

🔗 https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/

PHP2Shell in OT-Anlagen: warum die Lücke Jahre bleibt

PHP2Shell (CVE-2026-109618/-109619) wird breit angegriffen. Max Gilg erklärt, welche OT-Geräte PHP nutzen und was Betreiber jetzt tun sollten.

#OTSecurity #ICS #KRITIS #NIS2 #Cybersicherheit
https://ot-cyber.de/blog/php2shell-in-ot-anlagen-warum-die-luecke-jahre-bleibt.html

RCE via OOM corruption, CVE-2026-109618 ([GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

Wer nicht updaten kann:
RCE via OOM corruption (CVE-2026-109618):
- Set memory_limit=-1, preferably in a way applications can't override, such as php_admin_value in the FPM
- Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M.
- Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable allocation failure.

real elephants set memory_limit to -1

#php #php2shell #Cve2026109618

#php2shell - Für #Serveradmin , die noch ältere Versionen, zumindest eine zeitlang, benötigen, bietet @php Backports für die folgenden #PHP-Versionen an. So kann man eine gepachte Version selbst bauen.

#PHP74 https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619

#PHP80 https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619

#PHP81 https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619

#cve-2026-109618 #php2shell

Some info on the thing that’s going to break all our internet facing stuff…

https://www.melurna.com/blog/php2shell-php-vulnerability-cve-2026-109618/

#php #cve2026109618

"Plusieurs vulnérabilités critiques découvertes dans #PHP : installez immédiatement les mises à jour de sécurité"

"Deux vulnérabilités critiques dans PHP pourraient permettre à un attaquant d'exécuter du code malveillant sur les serveurs concernés sans avoir à s’authentifier. Des mises à jour de sécurité sont désormais disponibles. L'Office fédéral de la cybersécurité (OFCS) recommande de mettre à jour immédiatement les systèmes concernés. Outre les serveurs web, vérifiez également les applications et les appareils qui utilisent PHP comme composant intégré."
👇
https://www.bacs.admin.ch/fr/warnung-php-fr

🔍
👇
https://security-hub.ncsc.admin.ch/#/posts/13083

🇪🇺
👇
https://db.gcve.eu/vuln/CVE-2026-109618

#CyberVeille #PHP2shell

CVE: CVE (Common Vulnerabilities and Exposures) is the public list giving each disclosed software flaw a unique ID such as CVE-2026-109618, run by MITRE since 1999. https://ppc.land/cve/ #CVE #CyberSecurity #VulnerabilityManagement #InfoSec #SoftwareSecurity

Two serious vulnerabilities have been identified in PHP, which is used by around 70% of websites worldwide.

The PHP Foundation released fixes on October 21, 2026.

VulnCheck, Cloudflare and Patchstack reported attempts to investigate the flaws from malicious IP addresses.

One attempt tied to CVE-2026-109618 failed because the targeted file was not present.

Cloudflare also reported attempts to bypass defenses by changing…

https://en.hacks.gr/dyo-kena-asfaleias-stin-php-kai-idi-katagrafontai-apopeires-eisvolis/

#PHP #CVE2026109618 #PHPFoundation #Patchstack

📰 Fedora Haberi

PHP paketlerinde CVE-2026-109618/109619 güvenlik açıkları giderildi

PHP geliştiricileri yamaları yayınladı ancak 21 Ekim 2026 itibarıyla Fedora depolarında henüz mevcut değil. Açıklar kimlik doğrulama olmadan Uzak Kod Çalıştırma (RCE) riski taşıyor.

🔗 https://birolkurnaz.com/l/TVCUyO
📊 1 kaynak: Fedora-Discussion

#fedora #linux #haber

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on 2026-10-17 in MadPot telemetry, 4 days before public disclosure of CVE-2026-109618 & CVE-2026-109619. It originated from an IP associated w/a commercial anonymization network. While the vuln was under embargo, the targeting of a honeypot from an anonymized IP suggests the activity was conducted by a threat actor, tho it remains unclear how the actor acquired exploit information prior to disclosure.

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

#php2shell
Ok, dann werden wir mal unsere Server absichern, bis es entsprechende gepatchte Versionen von PHP gibt
Im Artikel sind entsprechende Maßnahmen gut beschrieben und erklärt, und auch, was nicht funktioniert.

Da ältere Versionen als #PHP82 keine Patches erhalten werden, muss ich diese wohl eben manuell absichern. (ja, ich nutze auch noch ältere Versionen)

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

#devadmin #serveradmin #cve #php #phpsecurity #phppatch #security

#Webuzo, Softaculous's hosting control panel for providers, resellers & site owners like CPANEL, has released an emergency release to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. #PHP #PHP2shell #Selfhosting #CVE

PHP InfoSec

Wise system administrators who have caught wind of this bug have taken measures already

It hasn't been patched yet but you can mitigate exposure of your systems.
Better yet, do what is written on tweakers.net

Quotes:

Make your store read-only or take it offline

If you can afford to take a PHP server offline for a day, do so. PHP core developer Gina Peter Banyard calls that the most sensible option. Several Dutch sites went offline as a precaution on October 21: tech site Tweakers, the House of Representatives (Tweede Kamer), the National Cyber Security Centre (NCSC) and security news site Security.NL.

Stop PHP-FPM and have your web server show a static maintenance page. The maintenance modes built into Magento and WordPress do not help: PHP still parses each request before the application checks for the maintenance flag.

If you cannot go offline, make the store read-only. Have your web server reject every request method other than GET and HEAD, for example in nginx:

if ($request_method !~ ^(GET|HEAD)$) {
return 503;
}

Quote:

Websites overnemen

De twee kritieke kwetsbaarheden in PHP (CVE-2026-109618 en CVE-2026-109619) hebben een score van 9,2 op de CVSS v4.0-schaal, die tot 10 gaat. Dat hoge cijfer is gebaseerd op de ernst van een kwetsbaarheid en op hoe makkelijk aanvallers die kunnen misbruiken. De kwetsbaarheden zouden al sinds versie 5.4.0 in PHP zitten, die in maart 2012 uitkwam. Aanvallers kunnen door de kwetsbaarheden eigen webpagina's publiceren. Daardoor kunnen zij mogelijk malware verspreiden. Daarnaast zou de zogeheten PHP2Shell-exploit het mogelijk maken om eigen code uit te voeren op kwetsbare servers.

Volgens verschillende beveiligingsadviezen kan het helpen om session.upload_progress.enabled uit te schakelen. Een bijbehorende tijdelijke oplossing zou zijn om session.use_strict_mode in te schakelen. Beveiligingsexpert Kevin Beaumont meldt dat de Linux-kernelbeveiligingsmodule AppArmor of SELinux ook bescherming biedt tegen misbruik van deze grote PHP-kwetsbaarheden.

I understand the NL language
Translate this if you don't

Jump to the sources read and work

Sources:

https://jackalsyn.com/posts/php-up-2026.html

https://sansec.io/research/php2shell

https://tweakers.net/

#PHP #bug #serious #infoSEC #programming #upgrade

Update: Patched PHP packages are now available for testing! After the community has helped verify them, we will release them to the production repositories.

Learn more and help with testing: https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/

Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?

; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M

; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0

RE: https://infosec.exchange/@Spartan_1986/117480764972910966

So, that build date got me thinking. What if Canonical did implement the fix, but they are not reporting all the build digits? I know. That's stupid. But fortunately I can check on that. I've a Pro account and the server is, of course, registered with the Pro binary installed. You can force any CVE update with a the command "sudo pro fix CVE-YYYY-XXXX". So I ran the command for the two CVEs involved with this vuln. Here's what I got:

*******************************
$ sudo pro fix CVE-2026-109618
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109618 is resolved.
$ sudo pro fix CVE-2026-109619
CVE-2026-109619: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109619

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109619 is resolved.
*******************************

Damn it Canonical! Digits f-ing matter!!! Why do you have to be so stupid. I frankly don't even know if I can trust this. It should report the correct version with 'php -v' you numbskulls. This is why I got out of system administration in the first place.

TR-102 Critical Remote Code Execution Vulnerabilities in PHP - CVE-2026-109618 and CVE-2026-109619

🔗 https://www.circl.lu/pub/tr-102/

#cve #vulnerabilitymanagement #cybersecurity #php

Amazon just pushed out 2023.12.20261021 but it does *not* fix CVE-2026-109618 and CVE-2026-109619 so that's cool, cool. No hurry, guys. https://explore.alas.aws.amazon.com

PHP:sta on löytynyt kaksi kriittistä haavoittuvuutta (CVE-2026-109618 ja CVE-2026-109619), joista Kyberturvallisuuskeskus on julkaissut tiedotteen. Korjattu PHP-versio julkaistaan tänään klo 17, ja asennamme sen ylläpitämillemme palvelimille heti julkaisun jälkeen.

Osalla palvelimista teemme päivityksen vaatimia valmistelutöitä jo ennen klo 17. Huoltoikkunan aikana sivustoilla voi esiintyä lyhyitä katkoja tai hitautta. Useimmilla sivustoilla päivitys ei näy käyttäjille lainkaan.

https://status.dude.fi/en/maintenance/1097234

#Tietoturva #PHP #Vulnerabilities #DigitoimistoDude #CVE

Claims of the PHP vulns being EITW:

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

php2shell Schwachstelle in PHP gefährdet viele Projekte (WordPress, Drupal, ...). Bald soll es PHP-Updates geben. Hoffen wir, dass die Hoster die schnell installieren.

https://borncity.com/blog/2026/10/21/php2shell-php-schwachstellen-cve-2026-109618-und-cve-2026-109619/

We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

#php2shell #php #CVE #eitw

PHP-Sicherheitslücke CVE-2026-109618 und CVE-2026-109619: @lmz empfiehlt Abschaltung von Nextclouds. Verständlich, aber für digitale Schule eine Katastrophe.
@univention, @Karlitschek und @lmz: Bis wann können wir hoffen, dass Patch da ist und wir NextCloud wieder online nehmen können? Wäre echt wichtig, dass das schnell klappt!
#eduBW
cc: @KM_BW
LMZ: https://docs.meine-schulplattform.de/xwiki/bin/view/Aktuelles%20und%20Serviceinformationen/21.10.2026%3A%20Sicherheitswarnung%20PHP%20%E2%80%93%20Ma%C3%9Fnahmen%20dringend%20empfohlen/

🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.

Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases

These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.

PHP has released security updates and recommends upgrading immediately.

Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/

#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. While the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.

https://vulnerability.circl.lu/bundle/bba240d0-7dfe-4f4f-94be-d6b640ddbc0e

#vulnerability #php

Important #CVE vulnerabilities affecting #PHP: https://cert.europa.eu/publications/security-advisories/2026-018/
php8.4 for #Debian has been updated today to 8.4.27:
```
php8.4 (8.4.27-1~deb13u1) trixie-security; urgency=high

* New upstream version 8.4.27
+ (CVE-2026-109618, CVE-2026-109619): Avoid state corruption via
bailout.

-- Ondřej Surý <ondrej@debian.org> Wed, 21 Oct 2026 09:53:46 +0200
```
And my personal server quickly updated with just a simple: apt update && apt upgrade

Thanks @ondrej!!

🔧 Dočasně vypínáme podporu přes FreeScout (helpdesk.oscloud.cz) kvůli kritické chybě v PHP. Znovu ji zapneme po aplikování opravy.

⚠️ Kritická zranitelnost v PHP, co to znamená pro OSCloud

PHP tým oznámil dvě kritické chyby (CVE-2026-109618 a CVE-2026-109619, obě CVSS 9.2). Mohou umožnit spuštění cizího kódu na serveru bez přihlášení. Oprava vychází dnes v 16:00 SEČ/CEST. Podle hlášení bezpečnostních firem už probíhají první útoky.

Kterých služeb se to týká:
• Nextcloud, WordPress, Pixelfed, FreeScout, a další aplikace postavené na PHP
• LAMP weby zákazníků (Apache + PHP), včetně těch, kde zatím běží jen úvodní stránka

Kterých ne:
• Mastodon, Matrix, PeerTube, Gitea (PHP nepoužívají)
• Weby a úložiště na statických souborech (Surfer)

Co děláme:
• FreeScout jsme vypnuli
• Další PHP aplikace a LAMP weby budeme vypínat postupně a vždy o tom budeme informovat zde. Počítejte s tím, že dočasně vypneme i Nextcloud, a to do vydání a nasazení opravy
• Jakmile budou dostupné opravené verze aplikací, nasadíme je co nejdřív
• Před vypnutím a updaty děláme zálohy

Co to znamená pro vás:
• Podpora přes FreeScout je do opravy nedostupná
• Nextcloud, LAMP weby a další PHP služby mohou být dnes nedostupné
• Pokud by se při updatu něco pokazilo, vracíme se ze zálohy maximálně 12 hodin zpět

Opravu nelze řešit pluginy ani updatem WordPressu, musí přijít nové PHP v rámci aktualizace aplikace. Pokud provozujete vlastní PHP web mimo OSCloud, aktualizujte PHP hned, jak vyjde oprava.

Děkujeme za trpělivost. Stav budeme průběžně aktualizovat v tomto vlákně.

#OSCloud #PHP #Bezpečnost

All affected users must patch against php2shell (CVE-2026-109618 / CVE-2026-109619). Due to the nature of some of the primitives involved, ASLR is not effective and arbitrary code execution/reuse/filesystem-level execution isn't a necessary component of exploitation in this case.

php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available | Ubuntu https://ubuntu.com//blog/php2shell-vulnerability-fixes-available

PHP : deux failles critiques ont fuité avant l’heure, un correctif d’urgence arrive ce 21 octobre ! https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP

PHP has released emergency updates for two severe runtime vulnerabilities named PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2.

The flaws affect nearly all PHP versions back to PHP 5.4.

Researchers noted that AI assisted in turning old primitives into working exploits, while Cloudflare observed early attack attempts before patches shipped.

Fixes are included in versions 8.5.12, 8.4.27, 8.3.36…

https://en.hacks.gr/epeigoyses-enimeroseis-asfaleias-gia-tin-php-logo-sovaron-kenon/

#PHP #PHP2Shell #CVE2026109618 #WebDev

OK, sorted.

If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619

Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)

In the meantime, I've pushed to my registries

* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump

Should be drop-in replacements

PHP2SH-Bug

Scheint so, dass der MIME-Parser/-Splitter bei Uploads bei PHP kapott ist.
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

Und nein, es muss kein Upload-Formular existieren - es reicht schon, den passenden Exploit an +irgendeine+ PHP-Seite zu schicken. Die muss vmtl. nicht mal existieren, weil der Parser da schon in Aktion trat (unklar, weiß da wer mehr?)?

Helfen dürfte, alles zu sperren, was im "Content:"-Header irgendwas mit "multipart* hat.

1/2

#php #php2shell

Id-SIRTII/CC just released (an hour ago) a security advisory regarding php2shell.

You can access the details here:
https://idsirtii.bssn.go.id/publications/advisories/security-advisory-kerentanan-pada-php2shell-cve-2026-109618-cve-2026-109619

@indonesia

#cybersecurity #infosec #indonesia #indonesiaNews #php2shell

I've temporarily blocked connections to Instafops.net and a few other sites that I host that use PHP. I've put up 503 pages and a 307 Redirect on the impacted websites.

The WordPress sites will probably be back tomorrow, Instafops may take a few days depending on docker image updates.

Apologies for any inconvenience this may cause.

#FediAdmin #PHP #cve2026109618 #cve2026109619 #pixelfed

Vorabinformation: Kritische Sicherheitslücken in PHP (CVE-2026-109618, CVE-2026-109619)

Das offizielle Sicherheitsupdate wird heute, am 21. Oktober 2026, um 14:00 UTC (16:00 Uhr MESZ) veröffentlicht.

Heute ist Patchday 😮

PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #RCE #ExploitedInTheWild #PoC #CyberSecurity

https://securityonline.info/php2shell-exploited-poc-public/?utm_source=mastodon&utm_medium=jetpack_social

Updates to Nextcloud package to fix CVE-2026-109618 and CVE-2026-109619 are out. Please update ASAP.

PHP ships an emergency security release today at 14:00 UTC. It fixes two critical bugs in PHP core (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2). The details leaked one day before the embargo ended.

Only PHP 8.2 and later get the fix. If you still have a PHP 7 box somewhere, today is a good day to find it.

My notes on what is confirmed and what to do:
https://www.abgeo.dev/blog/php2shell-critical-php-rce/

#PHP #InfoSec #CyberSecurity #DevOps #SysAdmin

Die zentralen Websites der Uni Freiburg sind vom Netz genommen worden. #PHP

https://rz.uni-freiburg.de/de/rz/aktuell/stoerungen/2026-10-21-10-39-massnahme-im-zusammenhang-mit-der-kritischen-schwachstelle-php-cve-2026-109618-und-cve-2026-109619

Kritisches PHP-Sicherheitsproblem: Websites offline

Sogar das BSI hat schon eine dringende Warnung veröffentlicht. Etwas hilfreicher ist der Text von Brian Krebs. Die besten und vor allem aktuellen Informationen gibt es beim SANS-ISC.
Beim jetzigen Kenntnisstand stellt sich die Lage so dar: In der FOSS Programmiersprache PHP wurden zwei Sicherheitslücken gefunden, die jetzt die Nummern CVE-2026-109618 und CVE-2026-109619 erhalten haben. Die zugrunde liegenden Schwachstellen existieren schon seit der Steinzeit, aber bisher war ihre eventuelle Ausnutzung so kompliziert, dass sie keine Gefahr darstellten. Mit Auftreten der KI hat sich das geändert. ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/10/21/kritisches-php-sicherheitsproblem-websites-offline/

#0day #cms #exploits #KI #provider #sicherheit #vorbeugen #wissen

Nothing here for PHP2Shell

On Wednesday PHP shipped emergency releases for two flaws in its core, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. A single request from somebody who never logged in can be enough to run code on the web server, and every PHP…

https://blogsh.app/posts/2026/nothing-here-for-php2shell/

#security #philosophy

🚨 Critical Alert from Karen IT
Two critical unauthenticated RCE vulnerabilities in PHP (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) have leaked early.

https://ksrc.karenit.net/blog/security-alert/urgent-php-remote-code-execution-vulnerabilities-(cve-2026-109618-&-cve-2026-109619)

Do not delay.

🚨 تنبيه حرج
ثغرتان حرجتان في PHP تسمحان بتنفيذ أكواد عن بُعد بدون مصادقة (CVE-2026-109618 و CVE-2026-109619، CVSS 9.2) تم تسريبهما مبكراً.
لا تتأخروا.

#PHP #ثغرات #أمن_السيبراني #PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ZeroDay #PatchNow #CyberSecurity #RCE #CVE

Le #PHP est une langage de nombreuses applications Web utilisées dans les domaines de #SHS (Wordpress, SPIP, etc.), de nombreux sites Web sont donc concernés. Appliquez bien vos mises à jour ! https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/

Anyone?
https://raw.githubusercontent.com/HOSTED-POWER/php_uploadprogress_guard/refs/heads/main/src/hp_uploadprogress_guard.c

#cybersecurity #CVE #cve2026109618 #cve2026109619

🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619

PoC: https://github.com/ikow/php2shell-poc

The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.

CVSS: 9.2 Critical
Affected: PHP 5.4.0 through 8.5.11
Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12

The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.

The php2shell fix is out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Two critical bugs (CVSS 9.2), both remote code execution without authentication. mod_php has the highest risk, but PHP-FPM and other SAPIs are affected too. There are source backports for 7.4, 8.0 and 8.1.

Update, then do a full restart, not a reload.

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

#PHP #InfoSec #CVE

Updates to Wordpress, FreeScout packages to fix CVE-2026-109618 and CVE-2026-109619 are out. Please update ASAP.

OpenAI udostępniło narzędzie (+skill) do weryfikacji, czy dany serwer ma podatną wersję PHP (CVE-2026-109618 + CVE-2026-109619).

Najprościej wywołać:
node phpcheck.js --local

Lokalnie wykrywa OK, ale zdalnie raczej jest bezużyteczne, bo czyta nagłówki HTTP w celu wykrycia wersji PHP, ale kto w obecnych czasach to eksponuje? 🤷‍♂️

Heutiger Tag zeigt ggf. mal, warum auf (End of Life) EOL achten bei #PHP Versionen, MySQL & Co doch sinnvoll ist. Ist ja immer Kostenfrage/Debatte, aber inzwischen schreibt auch DSGVO "aktuellen technischen Stand" (mit vertretbarem Aufwand) vor. There is no glory in prevention. 🫣
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

Alerte générale dans le monde #PHP :
“Upcoming Critical PHP Security Release” https://www.php.net/archive/2026.php#2026-10-20-1 et https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/

À toutes les contre-mesures qu'on voit passer pour #CVE-2026-109618 et #CVE-2026-109619 je rajouterais de filtrer la sortie vers internet de vos serveurs. Si un attaquant prend la main, qu'il ne puisse pas ressortir facilement et extraire des données.

Um 12 Uhr UTC haben wir heute alle PHP Instanzen abgeschaltet. Jetzt warten wir auf die Veröffentlichung der PHP-Fixes für CVE-2026-109618 und CVE-2026-109619. Eine erneute Freischaltung der PHP Instanzen wird nicht vor 16 Uhr UTC erwartet. #hosting #security #php2shell

🚨 If you run PHP (like most of the internet does), this one can’t wait: #PHP2Shell = 2 critical RCE flaws in PHP core leaked before the patch, with live attacks already reported.

Because CVE-2026-109618 & CVE-2026-109619 sit in PHP itself, every app on a vulnerable PHP version is exposed, no matter what runs on top.

That’s why we’re building detection in our Network Scanner + an exploit module in Sniper as you’re reading this. Stay tuned for the launch announcement!

What to do now:

Inventory every PHP install, including control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
Patch as soon as PHP’s release is out, then restart PHP-FPM or your web server
On PHP 8.1 or older? No fix is coming. Upgrade, or take those systems off the internet
Alert on PHP processes spawning shells, interpreters, or download tools

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

Faille #PHP:
https://loud-technology.com/insight/faille-rce-php-cve-2026-109618-cve-2026-109619/

"Toutes les installations PHP qui servent des requêtes web sont concernées : PHP-FPM, Apache mod_php, php-cgi, FrankenPHP et LiteSpeed.

Le risque est maximal avec (Apache) mod_php, pour lequel un exploit fonctionne avant même l’exécution du code applicatif.

Selon l’équipe sécurité de PHP, aucune configuration ne remplace la mise à jour."

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

#php #CISA #CVE

PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.

Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

🔗 https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619

#PHP2Shell: Wie ein #Speicherfehler zur #Shell wird.

CVE-2026-109618:

https://www.cve.org/CVERecord?id=CVE-2026-109618

CVE-2026-109619:

https://www.cve.org/CVERecord?id=CVE-2026-109619

https://youtube.com/watch?v=qXv8NAIFm9o

"Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed" 🤔 🕵️

https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html

#CVE2026109618 #CVE2026109619 #php #php2shell #exploit #cybersec #infosec

Der Patch sitzt. Die Frisur auch: Kritische Schwachstellen in PHP (CVE-2026-109618 und CVE-2026-109619).

#Nerdkram #Exploit

Critical CVE vulnerabilities were announced yesterday for PHP (CVE-2026-109618 and CVE-2026-109619). We have promptly responded to that and all servers in the #TDE infrastructure have already been updated.

Well, so far I have not been able to obtain PHP updates for Fedora 42, 43, and 44.

I am using this as a script:

#!/bin/bash

sudo dnf clean all
sudo dnf check-update php
sudo dnf update php\*

sudo dnf update

sudo systemctl restart php-fpm
# If using Apache:
sudo systemctl restart httpd
# If using Nginx:
# sudo systemctl restart nginx

rpm -q --changelog php-cli | grep -E "CVE-2026-109618|CVE-2026-109619"

La faille nommée « php2shell » regroupant 2 vulnérabilités critiques PHP (CVE-2026-109618 et CVE-2026-109619) est bien en cours de correction ou mitigation sur les serveurs que nous infogérons. Plus d'informations sur https://www.php.net/index.php#2026-10-20-1 et https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC #php2shell

@php vuln is up:
https://www.php.net/archive/2026.php#2026-10-21-5
https://www.php.net/ChangeLog-8.php#8.5.12

CVE-2026-109618 CVE-2026-109619

The PHP security team has released the patch for CVE-2026-109618 and CVE-2026-109619. Our team is now updating Passbolt Cloud and the self-hosted images (Docker, OVA, DigitalOcean). Passbolt Cloud will be restored once the update is deployed and verified.

Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Wenn statt Eurer Webseite grad das hier auftaucht,
wird im besten Fall nur deren Server mit dem richtigen Patch (Update) versehen

CVE-2026-109618
CVE-2026-109619

bzw

GHSA-w8hw-w9fx-j79w,
GHSA-6wmf-4rv5-p3rp

#php2shell

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.

https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

#eitw #php #php2shell #CVE

Security advisory: patches for #PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

https://community.opalstack.com/d/1729-security-advisory-patches-for-php2shell-cve-2026-109618-cve-2026-109619

Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:

The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Ubuntu has released security updates for php2shell (CVE-2026-109618 and CVE-2026-109619), a critical issue rated 9.2 on CVSS 4.0 that can allow remote code execution in PHP applications without authentication.

Updates cover Ubuntu 14.04 LTS through 26.10; Ubuntu Pro is required for 14.04, 16.04 and 18.04 LTS.

The separate eMudhra certificate issue could allow fake certificates if compromised.

Google, Microsoft, Apple and Mozilla…

https://en.hacks.gr/i-ubuntu-diorthonei-dyo-provlimata-asfaleias-se-efarmoges-php-kai-pistopoiitika-emudhra/

#Ubuntu #PHP #eMudhra #CVE2026109618

‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online.

Researchers report potential RCE.

CVE-2026-109618 and CVE-2026-109619.

Fixes scheduled for October 21, 14:00 UTC.

Details - https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

Hätte es ja gut gefunden, wenn mein Hoster mir irgendwas geschickt hätte. Oder es auf der Webseite Infos gegeben hätte. Nichts zu
(CVE-2026-109618) (CVE-2026-109619). Dabei ist das doch ein super Thema, um den Kunden klar zu machen: Wir haben das auf dem Schirm, wir arbeiten da dran, das ist unser Job und wir nehmen ihn ernst.

Oder verstehe ich hier was nicht?

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, could allow unauthenticated remote code execution, The Hacker News reports. Details of the flaws leaked ahead of disclosure, and PHP shipped an out-of-cycle emergency security release on October 21 to address them. https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web

https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

https://pentestit.com/php-cve-2026-109618-and-cve-2026-109619-what-we-know-about-php2shell/

Details about two critical-severity PHP vulnerabilities, dubbed PHP2Shell, have leaked online before the planned coordinated disclosure and release of official patches.
PHP has urged defenders to prepare to apply patches as soon as they become available for the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, which could enable remote code execution.

Oh my!

I’m curious about this. I wonder if this is something… useful?

https://cyberplace.social/@GossiTheDog/117474220875882526

#php #cve2026109618 #cve2026109619

⚠️ Vorsichtsmaßnahme: Verschiedene Webseiten und zentrale Webanwendungen vorübergehend abgeschaltet.

Aufgrund kurzfristig bekannt gewordener Sicherheitslücken in der weit verbreiteten Programmiersprache PHP müssen wir am heutigen Mittwoch, 21. Oktober 2026, vorsorglich verschiedene Websites und zentrale Dienste der Universität Freiburg abschalten, um unsere IT-Systeme und Daten zu schützen. Verschiedene Angebote werden daher vorübergehend nicht erreichbar sein.

Die Sicherheitslücken betreffen grundsätzlich alle Einrichtungen und Organisationen weltweit, die PHP-basierte Systeme einsetzen. Die PHP Foundation hat für heute Nachmittag Sicherheitsupdates angekündigt, mit denen die Schwachstellen behoben werden sollen. Sobald diese verfügbar sind, wird das Rechenzentrum der Universität die Updates einspielen und die Dienste überprüfen, damit die betroffenen Angebote schnellstmöglich wieder sicher bereitgestellt werden können.

Welche Websites und Webdienste betroffen sind und wann sie wieder zur Verfügung stehen, erfahren Sie auf dieser Seite, die wir regelmäßig aktualisieren: https://www.rz.uni-freiburg.de/de/rz/aktuell/stoerungen/2026-10-21-10-39-massnahme-im-zusammenhang-mit-der-kritischen-schwachstelle-php-cve-2026-109618-und-cve-2026-109619

#ufr_störung

I follow the updates on the status :
https://loud-technology.com/insight/faille-rce-php-cve-2026-109618-cve-2026-109619/

Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.

PHP2Shell (CVE-2026-109618, CVE-2026-109619): Zwei kritische RCE-Lücken in PHP und was getan werden muss

Wir werden das laufend aktualisieren ...

https://mint-secure.de/php2shell-kritische-rce-luecken-php/

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/38

If you use pfSense, you can run a command to force an update for the php issue. Granted this is a small vector of attack, as your webgui should be secure.

Warning though, it will kill any wireguard connections for a bit, as there is also a wireguard update.

2/2 - Critical PHP Vulnerabilities

"The PHP Foundation detailed the two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—which impact 'all PHP installations serving web requests' going back to PHP version 5, released in July 2004. However, only PHP 8.2 and newer are still supported and will receive patches, according to the alert. The PHP Foundation noted...ubiquitous and foundational web layers like PHP can persist forgotten and un-updated in historic internet infrastructure."

Lets face it, PHP Enthusisasts always kinda are dorks. Kinda.

Instagram: @programmersarealsohuman

#CVE-2026-109618, #CVE-2026-109619 #DEVSECOPS #INFOSEC

PHP fixed two remote code execution flaws today, CVE-2026-109618 and
CVE-2026-109619. Anything serving PHP is affected, whatever sits on top of it.

Two steps, and the second is missing from most of the advice going round:

1. Update PHP. 8.5.12, 8.4.27, 8.3.36, 8.2.35, or your distro's backport.
2. Restart PHP. A pool loads its binary once and serves from it until it
restarts, so the fix on disk reaches nothing already running.

PHP 8.1 is past end of life and gets no fix. Move those sites.

📰 Critical PHP2Shell RCE Flaws Leaked Ahead of Coordinated Patch

🚨 CRITICAL: Two RCE flaws in PHP dubbed "PHP2Shell" (CVE-2026-109618, CVE-2026-109619) were leaked before patches. Affects PHP 5.4+. Active exploitation is confirmed. Prepare for emergency patching now! #PHP #RCE #CyberSecurity

🔗 https://cyber.netsecops.io/articles/critical-php2shell-vulnerabilities-leaked-ahead-of-patch/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

📰 Critical RCE Vulnerabilities in PHP Affect Millions of Web Servers

Two critical RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) in PHP with a 9.2 CVSS score. PoC exists. Over 22M instances exposed. Patching is urgent. #PHP #Vulnerability #CyberSecurity #RCE

🔗 https://cyber.netsecops.io/articles/critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is a pair of critical RCE bugs in the PHP engine itself, not WordPress or plugins. A single unauthenticated request can lead to remote code execution. Fixed versions released 21 Oct: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 update nd restart PHP workers (php-fpm/mod_php). PHP ≤8.1 has no fix, requires upgrade.
Shared hosting? Ask your host to confirm patch.
No confirmed mass compromise per CISA as of 21 Oct, but active probing reported. #php #cyberSecurity

There are protections out there to help you buy time to patch all your systems for #php2shell

#Checkpoint #WAF and IPS both catch and prevent this attack

https://blog.checkpoint.com/security/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619

Workaround for 2 critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), disclosed on October 21, 2026

https://www.synoforum.com/threads/workaround-for-2-critical-vulnerabilities-in-the-php-engine-cve-2026-109618-and-cve-2026-109619-php2shell-disclosed-on-october-21-2026.16429/

#synoforum #synology #NAS

PHP2Shell: due RCE non autenticate nel runtime PHP, CVE-2026-109618 e CVE-2026-109619, CVSS v4 9.2. Colpite quasi tutte le versioni (fino alla 5.4), mod_php il caso peggiore. Fix: 8.5.12, 8.4.27, 8.3.36, 8.2.35, backport 7.4/8.0/8.1. Cloudflare e watchTowr riportano tentativi di sfruttamento, nessuna compromissione confermata. Aggiornare il runtime e riavviare Apache/FPM: il CMS non basta. Mitigazione parziale: session.upload_progress.enabled=0. https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w #infosec #PHP