Overview
- PHP Group
- PHP
- php-src
Description
Statistics
- 184 Posts
- 2740 Interactions
Fediverse
📣 Announcing the immediate availability of:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
‼️ These address the following critical security issues:
- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)
📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows
Read more: https://www.php.net/archive/2026.php#2026-10-21-5
Zwei kritische PHP-Lücken (CVE-2026-109618/109619, CVSS 9,2) ermöglichen unter bestimmten Bedingungen die Ausführung von Schadcode auf Webservern.
Dringend patchen! Für PHP 8.4 ist Version 8.4.27 erforderlich. Unter Debian 13 sind die Updates bereits verfügbar:
apt update && apt upgrade
Anschließend PHP-FPM neu starten:
systemctl restart php8.4-fpm
Auch andere Distributionen sollten jetzt aktualisiert werden!
🚨 There is a critical flaw in PHP that leads to remote code execution. A patch is has not been released yet.
If you run DokuWiki or any other PHP software, I would recommend shutting down the webserver until official mitigation steps and/or a patch is available.
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.
If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.
Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7
Kritische PHP-Sicherheitslücken (CVE-2026-109618/-109619)
Unser gesamtes Team arbeitet an der Betroffenheitsanalyse der bekannt gewordenen Schwachstellen und bereitet das Einspielen des PHP-Patches vor, der heute um 16 Uhr erscheinen soll.
Aufgrund der Wartungsarbeiten kann es zu Unterbrechungen kommen. Wir bitten um Ihr Verständnis.
Betreiben Sie eigene Systeme mit PHP? Führen Sie heute dringend das Update auf die neue Version durch.
Wir halten Sie auf dem Laufenden.
PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.
Here is what you need to know:
* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2
* The root is a decades-old design choice in PHP's error handling (described more in our post)
* There was evidence of in-the-wild exploitation pre-disclosure.
The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application
We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.
What to do right now:
The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.
Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012.
The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours.
Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.
Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.
Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com
Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618
Massive thanks to Ondřej Surý for spinning out vast php builds in a big hurry.
@deb seems to be quiet here, but the hours are definitely getting put in elsewhere. [ @ondrej !]
#php
#sury
#cve2026109618
#cve2026109619
Graphic is a paraphrase of XKCD, from https://codeberg.org/oerdnj/deb.sury.org/issues/145
Must-read blog post from the PHP foundation:
> [ In 2024 ] a PHP core developer contracted by the PHP Foundation found the first signs of the [out-of-memory] OOM problem behind CVE-2026-109618.
> the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months.
Notable PHP Enjoyer Palo Alto has posted their advisory on #PHP2Shell:
https://security.paloaltonetworks.com/CVE-2026-109618
ALL versions of Panorama and PAN-OS are affected. There's a fix coming, but right now I recommend shutting down anything exposed publicly, like VPN portals.
Critical PHP security vulnerabilities (CVE-2026-109618/-109619)
Our entire team is working on assessing the impact of the disclosed vulnerabilities and preparing to deploy the PHP patch, which is due to be released today at 4 pm.
Due to maintenance work, there may be some service interruptions. We apologise for any inconvenience caused.
Do you run your own systems using PHP? Please carry out the update to the new version as a matter of urgency today.
We will keep you informed.
#php2shell landed:
https://www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Wheeeeeeeee!
Fixes for PHP CVE-2026-109618 and CVE-2026-109619 have either landed or are on their way.
Fixed versions:
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
Check https://build.alpinelinux.org for the current status of each builder, and https://pkgs.alpinelinux.org to see what is present in each repository.
https://pkgs.alpinelinux.org/packages?name=php%253F%253F&branch=v3.24 for example shows the current version of PHP on the v3.24 branch.
The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.
https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914
⚠️PHP2Shell: Kritische PHP-Lücken CVE-2026-109618/109619⚠️
Zwei kritische PHP-Sicherheitslücken („PHP2Shell“) wurden am 20. Oktober vor Ablauf der Sperrfrist öffentlich. Das PHP-Team hat die Patch-Veröffentlichung für (16:00MEZ) vorgesehen.
Betroffen ist praktisch jede PHP-Website: #WordPress, #WooCommerce, #Drupal, #Joomla, #Magento. Das geleakte Exploit-Tool nennt PHP ab 5.4.0; offizielle Fixes unterstüzen nur PHP 8.2 bis 8.5 .
Palo finally published an advisory:
https://security.paloaltonetworks.com/CVE-2026-109618
No patch but some customers can get detections. Thanks, Palo. Fucking worthless fucks.
Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.
After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) will release standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), on Oct 21st.
The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.
PHP2Shell: mitigating with CRS and AppArmor before the patch
Update: patches are available now. Install them immediately.You should in no way continue to rely on Coreruleset and Apparmor only as protection against php2shell, now that the fixes are available. But definitely set up AppArmor and the Coreruleset on your systems for future reduced impact of such security vulnerabilities. These tools do help! In less than 2 hours, PHP will release a critical security update. This will fix two security vulnerabilities, CVE-2026-109618 and CVE-109619, which […]https://blog.frehi.be/2026/10/21/php2shell-mitigating-with-crs-and-apparmor-before-the-patch/
Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.
On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.
PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.
Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.
Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.
Go patch your #php. Now.
https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/
Hade tänkt ha en lugn onsdag med höstpromenad, gotta ned sig i programmeringsproblem och galamiddag på kvällen. Och så...
CVE-2026-109618 / -109619!!!
Matrix über die PHP-Releases:
https://ma.ttias.be/php-cve-2026-109618-patch/#package-status
CVE-2026-109618
各位博客/网站用php的友友们注意下这个史诗级漏洞， 官方还没出详细说明，但是已泄露、很多在野利用了。
临时修复方案
'session.upload_progress.enabled = Off '
参考：
https://t.me/usr_bin_cat/4464
https://t.me/usr_bin_cat/4466
https://t.me/bupt_moe/2851
📰 The PHP development team has released emergency security updates for two critical flaws that can allow unauthenticated remote code execution on affected web servers....
📡 Read full story here 👇
https://ctcnews.ca/2026/10/21/php-vulnerability-critical-php-flaws-patched-cve-2026-109618/
RE: https://chaos.social/@gsuberland/117476745061512773
Has anyone tried these PHP mitigation?
rce.CVE-2026-109618.enabled=Off rce.CVE-2026-109619.enabled=Off
I mean, it absolutely won't work as I just made it up, but I was wondering if anyone's tried it. :neocat_woozy:
For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:
Two critical vulnerabilities in PHP, nicknamed php2shell, were disclosed by PHP today: CVE-2026-109618 and CVE-2026-109619.
AlmaLinux 8, 9, and 10 all ship affected PHP versions, and we will release patched packages for testing today.
🔗 https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/
RCE via OOM corruption, CVE-2026-109618 ([GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
Wer nicht updaten kann:
RCE via OOM corruption (CVE-2026-109618):
- Set memory_limit=-1, preferably in a way applications can't override, such as php_admin_value in the FPM
- Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M.
- Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable allocation failure.
#php2shell - Für #Serveradmin , die noch ältere Versionen, zumindest eine zeitlang, benötigen, bietet @php Backports für die folgenden #PHP-Versionen an. So kann man eine gepachte Version selbst bauen.
#PHP74 https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619
#PHP80 https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619
#PHP81 https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619
The PHP team issued an urgent advisory for critical PHP vulnerabilities CVE-2026-109618 and 109619, threatening millions of exposed web servers.
Some info on the thing that’s going to break all our internet facing stuff…
https://www.melurna.com/blog/php2shell-php-vulnerability-cve-2026-109618/
"Plusieurs vulnérabilités critiques découvertes dans #PHP : installez immédiatement les mises à jour de sécurité"
"Deux vulnérabilités critiques dans PHP pourraient permettre à un attaquant d'exécuter du code malveillant sur les serveurs concernés sans avoir à s’authentifier. Des mises à jour de sécurité sont désormais disponibles. L'Office fédéral de la cybersécurité (OFCS) recommande de mettre à jour immédiatement les systèmes concernés. Outre les serveurs web, vérifiez également les applications et les appareils qui utilisent PHP comme composant intégré."
👇
https://www.bacs.admin.ch/fr/warnung-php-fr
🔍
👇
https://security-hub.ncsc.admin.ch/#/posts/13083
CVE: CVE (Common Vulnerabilities and Exposures) is the public list giving each disclosed software flaw a unique ID such as CVE-2026-109618, run by MITRE since 1999. https://ppc.land/cve/ #CVE #CyberSecurity #VulnerabilityManagement #InfoSec #SoftwareSecurity
#php2shell
Ok, dann werden wir mal unsere Server absichern, bis es entsprechende gepatchte Versionen von PHP gibt
Im Artikel sind entsprechende Maßnahmen gut beschrieben und erklärt, und auch, was nicht funktioniert.
Da ältere Versionen als #PHP82 keine Patches erhalten werden, muss ich diese wohl eben manuell absichern. (ja, ich nutze auch noch ältere Versionen)
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
#devadmin #serveradmin #cve #php #phpsecurity #phppatch #security
PHP InfoSec
Wise system administrators who have caught wind of this bug have taken measures already
It hasn't been patched yet but you can mitigate exposure of your systems.
Better yet, do what is written on tweakers.net
Quotes:
Make your store read-only or take it offline
If you can afford to take a PHP server offline for a day, do so. PHP core developer Gina Peter Banyard calls that the most sensible option. Several Dutch sites went offline as a precaution on October 21: tech site Tweakers, the House of Representatives (Tweede Kamer), the National Cyber Security Centre (NCSC) and security news site Security.NL.
Stop PHP-FPM and have your web server show a static maintenance page. The maintenance modes built into Magento and WordPress do not help: PHP still parses each request before the application checks for the maintenance flag.
If you cannot go offline, make the store read-only. Have your web server reject every request method other than GET and HEAD, for example in nginx:
if ($request_method !~ ^(GET|HEAD)$) {
return 503;
}
Quote:
Websites overnemen
De twee kritieke kwetsbaarheden in PHP (CVE-2026-109618 en CVE-2026-109619) hebben een score van 9,2 op de CVSS v4.0-schaal, die tot 10 gaat. Dat hoge cijfer is gebaseerd op de ernst van een kwetsbaarheid en op hoe makkelijk aanvallers die kunnen misbruiken. De kwetsbaarheden zouden al sinds versie 5.4.0 in PHP zitten, die in maart 2012 uitkwam. Aanvallers kunnen door de kwetsbaarheden eigen webpagina's publiceren. Daardoor kunnen zij mogelijk malware verspreiden. Daarnaast zou de zogeheten PHP2Shell-exploit het mogelijk maken om eigen code uit te voeren op kwetsbare servers.
Volgens verschillende beveiligingsadviezen kan het helpen om session.upload_progress.enabled uit te schakelen. Een bijbehorende tijdelijke oplossing zou zijn om session.use_strict_mode in te schakelen. Beveiligingsexpert Kevin Beaumont meldt dat de Linux-kernelbeveiligingsmodule AppArmor of SELinux ook bescherming biedt tegen misbruik van deze grote PHP-kwetsbaarheden.
I understand the NL language
Translate this if you don't
Jump to the sources read and work
Sources:
https://jackalsyn.com/posts/php-up-2026.html
Update: Patched PHP packages are now available for testing! After the community has helped verify them, we will release them to the production repositories.
Learn more and help with testing: https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
httpd(8):
header block "Content-Type" "*multipart*" 403 "multipart blocked"
relayd(8):
block request quick header "Content-Type" value pattern "[Mm][Uu][Ll][Tt][Ii][Pp][Aa][Rr][Tt]" label "multipart blocked"
Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?
; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M
; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0
TR-102 Critical Remote Code Execution Vulnerabilities in PHP - CVE-2026-109618 and CVE-2026-109619
RE: https://infosec.exchange/@Spartan_1986/117480764972910966
So, that build date got me thinking. What if Canonical did implement the fix, but they are not reporting all the build digits? I know. That's stupid. But fortunately I can check on that. I've a Pro account and the server is, of course, registered with the Pro binary installed. You can force any CVE update with a the command "sudo pro fix CVE-YYYY-XXXX". So I ran the command for the two CVEs involved with this vuln. Here's what I got:
*******************************
$ sudo pro fix CVE-2026-109618
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618
1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.
✔ CVE-2026-109618 is resolved.
$ sudo pro fix CVE-2026-109619
CVE-2026-109619: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109619
1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.
✔ CVE-2026-109619 is resolved.
*******************************
Damn it Canonical! Digits f-ing matter!!! Why do you have to be so stupid. I frankly don't even know if I can trust this. It should report the correct version with 'php -v' you numbskulls. This is why I got out of system administration in the first place.
Temporarily shut down a bunch of websites including aidtoukraine.nl and wereldkoffie.eu better safe than sorry.
#php2shell
Critical #PHP #RCE: #CVE-2026-109618 and #CVE-2026-109619
PHP:sta on löytynyt kaksi kriittistä haavoittuvuutta (CVE-2026-109618 ja CVE-2026-109619), joista Kyberturvallisuuskeskus on julkaissut tiedotteen. Korjattu PHP-versio julkaistaan tänään klo 17, ja asennamme sen ylläpitämillemme palvelimille heti julkaisun jälkeen.
Osalla palvelimista teemme päivityksen vaatimia valmistelutöitä jo ennen klo 17. Huoltoikkunan aikana sivustoilla voi esiintyä lyhyitä katkoja tai hitautta. Useimmilla sivustoilla päivitys ei näy käyttäjille lainkaan.
php2shell Schwachstelle in PHP gefährdet viele Projekte (WordPress, Drupal, ...). Bald soll es PHP-Updates geben. Hoffen wir, dass die Hoster die schnell installieren.
We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.
🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.
Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases
These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.
PHP has released security updates and recommends upgrading immediately.
Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/
#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. While the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.
https://vulnerability.circl.lu/bundle/bba240d0-7dfe-4f4f-94be-d6b640ddbc0e
Important #CVE vulnerabilities affecting #PHP: https://cert.europa.eu/publications/security-advisories/2026-018/
php8.4 for #Debian has been updated today to 8.4.27:
```
php8.4 (8.4.27-1~deb13u1) trixie-security; urgency=high
* New upstream version 8.4.27
+ (CVE-2026-109618, CVE-2026-109619): Avoid state corruption via
bailout.
-- Ondřej Surý <ondrej@debian.org> Wed, 21 Oct 2026 09:53:46 +0200
```
And my personal server quickly updated with just a simple: apt update && apt upgrade
Thanks @ondrej!!
🔧 Dočasně vypínáme podporu přes FreeScout (helpdesk.oscloud.cz) kvůli kritické chybě v PHP. Znovu ji zapneme po aplikování opravy.
⚠️ Kritická zranitelnost v PHP, co to znamená pro OSCloud
PHP tým oznámil dvě kritické chyby (CVE-2026-109618 a CVE-2026-109619, obě CVSS 9.2). Mohou umožnit spuštění cizího kódu na serveru bez přihlášení. Oprava vychází dnes v 16:00 SEČ/CEST. Podle hlášení bezpečnostních firem už probíhají první útoky.
Kterých služeb se to týká:
• Nextcloud, WordPress, Pixelfed, FreeScout, a další aplikace postavené na PHP
• LAMP weby zákazníků (Apache + PHP), včetně těch, kde zatím běží jen úvodní stránka
Kterých ne:
• Mastodon, Matrix, PeerTube, Gitea (PHP nepoužívají)
• Weby a úložiště na statických souborech (Surfer)
Co děláme:
• FreeScout jsme vypnuli
• Další PHP aplikace a LAMP weby budeme vypínat postupně a vždy o tom budeme informovat zde. Počítejte s tím, že dočasně vypneme i Nextcloud, a to do vydání a nasazení opravy
• Jakmile budou dostupné opravené verze aplikací, nasadíme je co nejdřív
• Před vypnutím a updaty děláme zálohy
Co to znamená pro vás:
• Podpora přes FreeScout je do opravy nedostupná
• Nextcloud, LAMP weby a další PHP služby mohou být dnes nedostupné
• Pokud by se při updatu něco pokazilo, vracíme se ze zálohy maximálně 12 hodin zpět
Opravu nelze řešit pluginy ani updatem WordPressu, musí přijít nové PHP v rámci aktualizace aplikace. Pokud provozujete vlastní PHP web mimo OSCloud, aktualizujte PHP hned, jak vyjde oprava.
Děkujeme za trpělivost. Stav budeme průběžně aktualizovat v tomto vlákně.
All affected users must patch against php2shell (CVE-2026-109618 / CVE-2026-109619). Due to the nature of some of the primitives involved, ASLR is not effective and arbitrary code execution/reuse/filesystem-level execution isn't a necessary component of exploitation in this case.
RE: https://phpc.social/@Girgias/117476477429221001
Re: PHP CVE-2026-109618 & CVE-2026-109619
php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available | Ubuntu https://ubuntu.com//blog/php2shell-vulnerability-fixes-available
PHP : deux failles critiques ont fuité avant l’heure, un correctif d’urgence arrive ce 21 octobre ! https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP
PHP has released emergency updates for two severe runtime vulnerabilities named PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2.
The flaws affect nearly all PHP versions back to PHP 5.4.
Researchers noted that AI assisted in turning old primitives into working exploits, while Cloudflare observed early attack attempts before patches shipped.
Fixes are included in versions 8.5.12, 8.4.27, 8.3.36…
https://en.hacks.gr/epeigoyses-enimeroseis-asfaleias-gia-tin-php-logo-sovaron-kenon/
PHP2SH-Bug
Scheint so, dass der MIME-Parser/-Splitter bei Uploads bei PHP kapott ist.
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
Und nein, es muss kein Upload-Formular existieren - es reicht schon, den passenden Exploit an +irgendeine+ PHP-Seite zu schicken. Die muss vmtl. nicht mal existieren, weil der Parser da schon in Aktion trat (unklar, weiß da wer mehr?)?
Helfen dürfte, alles zu sperren, was im "Content:"-Header irgendwas mit "multipart* hat.
1/2
#php #php2shell
I've temporarily blocked connections to Instafops.net and a few other sites that I host that use PHP. I've put up 503 pages and a 307 Redirect on the impacted websites.
The WordPress sites will probably be back tomorrow, Instafops may take a few days depending on docker image updates.
Apologies for any inconvenience this may cause.
Vorabinformation: Kritische Sicherheitslücken in PHP (CVE-2026-109618, CVE-2026-109619)
Das offizielle Sicherheitsupdate wird heute, am 21. Oktober 2026, um 14:00 UTC (16:00 Uhr MESZ) veröffentlicht.
Heute ist Patchday 😮
looks like some PHP RCE (CVE-2026-109618 / CVE-2026-109619 / PHP-UP-2026) deets started to drop.
as a LAMP shared webhoster we're obviously Very Excited™
Updates to Nextcloud package to fix CVE-2026-109618 and CVE-2026-109619 are out. Please update ASAP.
PHP ships an emergency security release today at 14:00 UTC. It fixes two critical bugs in PHP core (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2). The details leaked one day before the embargo ended.
Only PHP 8.2 and later get the fix. If you still have a PHP 7 box somewhere, today is a good day to find it.
My notes on what is confirmed and what to do:
https://www.abgeo.dev/blog/php2shell-critical-php-rce/
Die zentralen Websites der Uni Freiburg sind vom Netz genommen worden. #PHP
Kritisches PHP-Sicherheitsproblem: Websites offline
Sogar das BSI hat schon eine dringende Warnung veröffentlicht. Etwas hilfreicher ist der Text von Brian Krebs. Die besten und vor allem aktuellen Informationen gibt es beim SANS-ISC.
Beim jetzigen Kenntnisstand stellt sich die Lage so dar: In der FOSS Programmiersprache PHP wurden zwei Sicherheitslücken gefunden, die jetzt die Nummern CVE-2026-109618 und CVE-2026-109619 erhalten haben. Die zugrunde liegenden Schwachstellen existieren schon seit der Steinzeit, aber bisher war ihre eventuelle Ausnutzung so kompliziert, dass sie keine Gefahr darstellten. Mit Auftreten der KI hat sich das geändert. ... Weiterlesen:
#0day #cms #exploits #KI #provider #sicherheit #vorbeugen #wissen
🚨 Critical Alert from Karen IT
Two critical unauthenticated RCE vulnerabilities in PHP (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) have leaked early.
Do not delay.
🚨 تنبيه حرج
ثغرتان حرجتان في PHP تسمحان بتنفيذ أكواد عن بُعد بدون مصادقة (CVE-2026-109618 و CVE-2026-109619، CVSS 9.2) تم تسريبهما مبكراً.
لا تتأخروا.
#PHP #ثغرات #أمن_السيبراني #PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ZeroDay #PatchNow #CyberSecurity #RCE #CVE
Le #PHP est une langage de nombreuses applications Web utilisées dans les domaines de #SHS (Wordpress, SPIP, etc.), de nombreux sites Web sont donc concernés. Appliquez bien vos mises à jour ! https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/
🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619
PoC: https://github.com/ikow/php2shell-poc
The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.
CVSS: 9.2 Critical
Affected: PHP 5.4.0 through 8.5.11
Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12
The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.
The php2shell fix is out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Two critical bugs (CVSS 9.2), both remote code execution without authentication. mod_php has the highest risk, but PHP-FPM and other SAPIs are affected too. There are source backports for 7.4, 8.0 and 8.1.
Update, then do a full restart, not a reload.
Advisory: https://www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Updates to Wordpress, FreeScout packages to fix CVE-2026-109618 and CVE-2026-109619 are out. Please update ASAP.
A PHP security release on Oct 21 fixes two CVSS 9.2 flaws, CVE-2026-109618 and CVE-2026-109619, leaked as remote code execution bugs.
#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ZeroDay #PatchNow #CyberSecurity
PHP-UP-2026 https://jackalsyn.com/posts/php-up-2026.html
PHP session.upload_progress Use After Free / CVE-2026-109618 / CVE-2026-109619 / CVSS scores of 9.2 https://cert.europa.eu/publications/security-advisories/2026-018/
Alerte générale dans le monde #PHP :
“Upcoming Critical PHP Security Release” https://www.php.net/archive/2026.php#2026-10-20-1 et https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/
Um 12 Uhr UTC haben wir heute alle PHP Instanzen abgeschaltet. Jetzt warten wir auf die Veröffentlichung der PHP-Fixes für CVE-2026-109618 und CVE-2026-109619. Eine erneute Freischaltung der PHP Instanzen wird nicht vor 16 Uhr UTC erwartet. #hosting #security #php2shell
🚨 If you run PHP (like most of the internet does), this one can’t wait: #PHP2Shell = 2 critical RCE flaws in PHP core leaked before the patch, with live attacks already reported.
Because CVE-2026-109618 & CVE-2026-109619 sit in PHP itself, every app on a vulnerable PHP version is exposed, no matter what runs on top.
That’s why we’re building detection in our Network Scanner + an exploit module in Sniper as you’re reading this. Stay tuned for the launch announcement!
What to do now:
Inventory every PHP install, including control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
Patch as soon as PHP’s release is out, then restart PHP-FPM or your web server
On PHP 8.1 or older? No fix is coming. Upgrade, or take those systems off the internet
Alert on PHP processes spawning shells, interpreters, or download tools
#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking
Faille #PHP:
https://loud-technology.com/insight/faille-rce-php-cve-2026-109618-cve-2026-109619/
"Toutes les installations PHP qui servent des requêtes web sont concernées : PHP-FPM, Apache mod_php, php-cgi, FrankenPHP et LiteSpeed.
Le risque est maximal avec (Apache) mod_php, pour lequel un exploit fonctionne avant même l’exécution du code applicatif.
Selon l’équipe sécurité de PHP, aucune configuration ne remplace la mise à jour."
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.
PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.
Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
OpenAI udostępniło narzędzie (+skill) do weryfikacji, czy dany serwer ma podatną wersję PHP (CVE-2026-109618 + CVE-2026-109619).
Najprościej wywołać:
node phpcheck.js --local
Lokalnie wykrywa OK, ale zdalnie raczej jest bezużyteczne, bo czyta nagłówki HTTP w celu wykrycia wersji PHP, ale kto w obecnych czasach to eksponuje? 🤷♂️
Well, so far I have not been able to obtain PHP updates for Fedora 42, 43, and 44.
I am using this as a script:
#!/bin/bash
sudo dnf clean all
sudo dnf check-update php
sudo dnf update php\*
sudo dnf update
sudo systemctl restart php-fpm
# If using Apache:
sudo systemctl restart httpd
# If using Nginx:
# sudo systemctl restart nginx
rpm -q --changelog php-cli | grep -E "CVE-2026-109618|CVE-2026-109619"
#PHP CVE-2026-109618 and CVE-2026-109619: What you should do now - Vincent Schmalbach
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
La faille nommée « php2shell » regroupant 2 vulnérabilités critiques PHP (CVE-2026-109618 et CVE-2026-109619) est bien en cours de correction ou mitigation sur les serveurs que nous infogérons. Plus d'informations sur https://www.php.net/index.php#2026-10-20-1 et https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC #php2shell
@php vuln is up:
https://www.php.net/archive/2026.php#2026-10-21-5
https://www.php.net/ChangeLog-8.php#8.5.12
CVE-2026-109618 CVE-2026-109619
The PHP security team has released the patch for CVE-2026-109618 and CVE-2026-109619. Our team is now updating Passbolt Cloud and the self-hosted images (Docker, OVA, DigitalOcean). Passbolt Cloud will be restored once the update is deployed and verified.
Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
Wenn statt Eurer Webseite grad das hier auftaucht,
wird im besten Fall nur deren Server mit dem richtigen Patch (Update) versehen
CVE-2026-109618
CVE-2026-109619
bzw
GHSA-w8hw-w9fx-j79w,
GHSA-6wmf-4rv5-p3rp
watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.
https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
Security advisory: patches for #PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
PHP maintainers have announced upcoming updates for two high-severity vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying a severity score of 9.2.
Researchers at watchTowr have confirmed the findings.
Reports also indicate the existence of a 'PHP2Shell' tool purportedly capable of exploiting these flaws against platforms like WordPress, Joomla, and Drupal.
The issues appear to impact PHP versions d…
https://en.hacks.gr/krisimi-proeidopoiisi-gia-tin-php-erchontai-amesa-enimeroseis-asfaleias/
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, could allow unauthenticated remote code execution, The Hacker News reports. Details of the flaws leaked ahead of disclosure, and PHP shipped an out-of-cycle emergency security release on October 21 to address them. https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web
PHP2Shell exposes two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619. Learn the risks, affected versions, mitigations and patching stepshttps://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/
Heutiger Tag zeigt ggf. mal, warum auf (End of Life) EOL achten bei #PHP Versionen, MySQL & Co doch sinnvoll ist. Ist ja immer Kostenfrage/Debatte, aber inzwischen schreibt auch DSGVO "aktuellen technischen Stand" (mit vertretbarem Aufwand) vor. There is no glory in prevention. 🫣
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
Details about two critical-severity PHP vulnerabilities, dubbed PHP2Shell, have leaked online before the planned coordinated disclosure and release of official patches.
PHP has urged defenders to prepare to apply patches as soon as they become available for the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, which could enable remote code execution.
Oh my!
I’m curious about this. I wonder if this is something… useful?
⚠️ Vorsichtsmaßnahme: Verschiedene Webseiten und zentrale Webanwendungen vorübergehend abgeschaltet.
Aufgrund kurzfristig bekannt gewordener Sicherheitslücken in der weit verbreiteten Programmiersprache PHP müssen wir am heutigen Mittwoch, 21. Oktober 2026, vorsorglich verschiedene Websites und zentrale Dienste der Universität Freiburg abschalten, um unsere IT-Systeme und Daten zu schützen. Verschiedene Angebote werden daher vorübergehend nicht erreichbar sein.
Die Sicherheitslücken betreffen grundsätzlich alle Einrichtungen und Organisationen weltweit, die PHP-basierte Systeme einsetzen. Die PHP Foundation hat für heute Nachmittag Sicherheitsupdates angekündigt, mit denen die Schwachstellen behoben werden sollen. Sobald diese verfügbar sind, wird das Rechenzentrum der Universität die Updates einspielen und die Dienste überprüfen, damit die betroffenen Angebote schnellstmöglich wieder sicher bereitgestellt werden können.
Welche Websites und Webdienste betroffen sind und wann sie wieder zur Verfügung stehen, erfahren Sie auf dieser Seite, die wir regelmäßig aktualisieren: https://www.rz.uni-freiburg.de/de/rz/aktuell/stoerungen/2026-10-21-10-39-massnahme-im-zusammenhang-mit-der-kritischen-schwachstelle-php-cve-2026-109618-und-cve-2026-109619
I follow the updates on the status :
https://loud-technology.com/insight/faille-rce-php-cve-2026-109618-cve-2026-109619/
Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.
PHP2Shell (CVE-2026-109618, CVE-2026-109619): Zwei kritische RCE-Lücken in PHP und was getan werden muss
Wir werden das laufend aktualisieren ...
OK, sorted.
If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619
Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)
In the meantime, I've pushed to my registries
* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump
Should be drop-in replacements
If you use pfSense, you can run a command to force an update for the php issue. Granted this is a small vector of attack, as your webgui should be secure.
Warning though, it will kill any wireguard connections for a bit, as there is also a wireguard update.
2/2 - Critical PHP Vulnerabilities
"The PHP Foundation detailed the two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—which impact 'all PHP installations serving web requests' going back to PHP version 5, released in July 2004. However, only PHP 8.2 and newer are still supported and will receive patches, according to the alert. The PHP Foundation noted...ubiquitous and foundational web layers like PHP can persist forgotten and un-updated in historic internet infrastructure."
Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:
The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Lets face it, PHP Enthusisasts always kinda are dorks. Kinda.
Instagram: @programmersarealsohuman
#CVE-2026-109618, #CVE-2026-109619 #DEVSECOPS #INFOSEC
PHP-Sicherheitslücke CVE-2026-109618 und CVE-2026-109619: @lmz empfiehlt Abschaltung von Nextclouds. Verständlich, aber für digitale Schule eine Katastrophe.
@univention, @Karlitschek und @lmz: Bis wann können wir hoffen, dass Patch da ist und wir NextCloud wieder online nehmen können? Wäre echt wichtig, dass das schnell klappt!
#eduBW
cc: @KM_BW
LMZ: https://docs.meine-schulplattform.de/xwiki/bin/view/Aktuelles%20und%20Serviceinformationen/21.10.2026%3A%20Sicherheitswarnung%20PHP%20%E2%80%93%20Ma%C3%9Fnahmen%20dringend%20empfohlen/
PHP fixed two remote code execution flaws today, CVE-2026-109618 and
CVE-2026-109619. Anything serving PHP is affected, whatever sits on top of it.
Two steps, and the second is missing from most of the advice going round:
1. Update PHP. 8.5.12, 8.4.27, 8.3.36, 8.2.35, or your distro's backport.
2. Restart PHP. A pool loads its binary once and serves from it until it
restarts, so the fix on disk reaches nothing already running.
PHP 8.1 is past end of life and gets no fix. Move those sites.
📰 Critical PHP2Shell RCE Flaws Leaked Ahead of Coordinated Patch
🚨 CRITICAL: Two RCE flaws in PHP dubbed "PHP2Shell" (CVE-2026-109618, CVE-2026-109619) were leaked before patches. Affects PHP 5.4+. Active exploitation is confirmed. Prepare for emergency patching now! #PHP #RCE #CyberSecurity
Bluesky
Overview
- PHP Group
- PHP
- php-src
Description
Statistics
- 150 Posts
- 2355 Interactions
Fediverse
📣 Announcing the immediate availability of:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
‼️ These address the following critical security issues:
- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)
📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows
Read more: https://www.php.net/archive/2026.php#2026-10-21-5
🚨 There is a critical flaw in PHP that leads to remote code execution. A patch is has not been released yet.
If you run DokuWiki or any other PHP software, I would recommend shutting down the webserver until official mitigation steps and/or a patch is available.
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.
If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.
Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7
PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.
Here is what you need to know:
* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2
* The root is a decades-old design choice in PHP's error handling (described more in our post)
* There was evidence of in-the-wild exploitation pre-disclosure.
The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application
We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.
What to do right now:
The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.
Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012.
The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours.
Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.
Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.
Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com
Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618
Massive thanks to Ondřej Surý for spinning out vast php builds in a big hurry.
@deb seems to be quiet here, but the hours are definitely getting put in elsewhere. [ @ondrej !]
#php
#sury
#cve2026109618
#cve2026109619
Graphic is a paraphrase of XKCD, from https://codeberg.org/oerdnj/deb.sury.org/issues/145
#php2shell landed:
https://www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Wheeeeeeeee!
Fixes for PHP CVE-2026-109618 and CVE-2026-109619 have either landed or are on their way.
Fixed versions:
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
Check https://build.alpinelinux.org for the current status of each builder, and https://pkgs.alpinelinux.org to see what is present in each repository.
https://pkgs.alpinelinux.org/packages?name=php%253F%253F&branch=v3.24 for example shows the current version of PHP on the v3.24 branch.
The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.
https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914
Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.
On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.
PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.
Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.
Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.
Go patch your #php. Now.
https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/
RE: https://chaos.social/@gsuberland/117476745061512773
Has anyone tried these PHP mitigation?
rce.CVE-2026-109618.enabled=Off rce.CVE-2026-109619.enabled=Off
I mean, it absolutely won't work as I just made it up, but I was wondering if anyone's tried it. :neocat_woozy:
For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:
Two critical vulnerabilities in PHP, nicknamed php2shell, were disclosed by PHP today: CVE-2026-109618 and CVE-2026-109619.
AlmaLinux 8, 9, and 10 all ship affected PHP versions, and we will release patched packages for testing today.
🔗 https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/
RCE via stale global state, CVE-2026-109619 ([GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
RCE via stale global state (CVE-2026-109619):
- Set session.upload_progress.enabled=0 and restart every worker.
- On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
- Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup.
Das passiert, wenn ich auf dem einen Server
sudo pro fix CVE-2026-109619sudo pro fix USN-8948-1
ausführe. Eigenartig...
#php2shell
Ok, dann werden wir mal unsere Server absichern, bis es entsprechende gepatchte Versionen von PHP gibt
Im Artikel sind entsprechende Maßnahmen gut beschrieben und erklärt, und auch, was nicht funktioniert.
Da ältere Versionen als #PHP82 keine Patches erhalten werden, muss ich diese wohl eben manuell absichern. (ja, ich nutze auch noch ältere Versionen)
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
#devadmin #serveradmin #cve #php #phpsecurity #phppatch #security
PHP InfoSec
Wise system administrators who have caught wind of this bug have taken measures already
It hasn't been patched yet but you can mitigate exposure of your systems.
Better yet, do what is written on tweakers.net
Quotes:
Make your store read-only or take it offline
If you can afford to take a PHP server offline for a day, do so. PHP core developer Gina Peter Banyard calls that the most sensible option. Several Dutch sites went offline as a precaution on October 21: tech site Tweakers, the House of Representatives (Tweede Kamer), the National Cyber Security Centre (NCSC) and security news site Security.NL.
Stop PHP-FPM and have your web server show a static maintenance page. The maintenance modes built into Magento and WordPress do not help: PHP still parses each request before the application checks for the maintenance flag.
If you cannot go offline, make the store read-only. Have your web server reject every request method other than GET and HEAD, for example in nginx:
if ($request_method !~ ^(GET|HEAD)$) {
return 503;
}
Quote:
Websites overnemen
De twee kritieke kwetsbaarheden in PHP (CVE-2026-109618 en CVE-2026-109619) hebben een score van 9,2 op de CVSS v4.0-schaal, die tot 10 gaat. Dat hoge cijfer is gebaseerd op de ernst van een kwetsbaarheid en op hoe makkelijk aanvallers die kunnen misbruiken. De kwetsbaarheden zouden al sinds versie 5.4.0 in PHP zitten, die in maart 2012 uitkwam. Aanvallers kunnen door de kwetsbaarheden eigen webpagina's publiceren. Daardoor kunnen zij mogelijk malware verspreiden. Daarnaast zou de zogeheten PHP2Shell-exploit het mogelijk maken om eigen code uit te voeren op kwetsbare servers.
Volgens verschillende beveiligingsadviezen kan het helpen om session.upload_progress.enabled uit te schakelen. Een bijbehorende tijdelijke oplossing zou zijn om session.use_strict_mode in te schakelen. Beveiligingsexpert Kevin Beaumont meldt dat de Linux-kernelbeveiligingsmodule AppArmor of SELinux ook bescherming biedt tegen misbruik van deze grote PHP-kwetsbaarheden.
I understand the NL language
Translate this if you don't
Jump to the sources read and work
Sources:
https://jackalsyn.com/posts/php-up-2026.html
Update: Patched PHP packages are now available for testing! After the community has helped verify them, we will release them to the production repositories.
Learn more and help with testing: https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
httpd(8):
header block "Content-Type" "*multipart*" 403 "multipart blocked"
relayd(8):
block request quick header "Content-Type" value pattern "[Mm][Uu][Ll][Tt][Ii][Pp][Aa][Rr][Tt]" label "multipart blocked"
Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?
; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M
; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0
TR-102 Critical Remote Code Execution Vulnerabilities in PHP - CVE-2026-109618 and CVE-2026-109619
RE: https://infosec.exchange/@Spartan_1986/117480764972910966
So, that build date got me thinking. What if Canonical did implement the fix, but they are not reporting all the build digits? I know. That's stupid. But fortunately I can check on that. I've a Pro account and the server is, of course, registered with the Pro binary installed. You can force any CVE update with a the command "sudo pro fix CVE-YYYY-XXXX". So I ran the command for the two CVEs involved with this vuln. Here's what I got:
*******************************
$ sudo pro fix CVE-2026-109618
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618
1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.
✔ CVE-2026-109618 is resolved.
$ sudo pro fix CVE-2026-109619
CVE-2026-109619: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109619
1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.
✔ CVE-2026-109619 is resolved.
*******************************
Damn it Canonical! Digits f-ing matter!!! Why do you have to be so stupid. I frankly don't even know if I can trust this. It should report the correct version with 'php -v' you numbskulls. This is why I got out of system administration in the first place.
Temporarily shut down a bunch of websites including aidtoukraine.nl and wereldkoffie.eu better safe than sorry.
#php2shell
Critical #PHP #RCE: #CVE-2026-109618 and #CVE-2026-109619
PHP:sta on löytynyt kaksi kriittistä haavoittuvuutta (CVE-2026-109618 ja CVE-2026-109619), joista Kyberturvallisuuskeskus on julkaissut tiedotteen. Korjattu PHP-versio julkaistaan tänään klo 17, ja asennamme sen ylläpitämillemme palvelimille heti julkaisun jälkeen.
Osalla palvelimista teemme päivityksen vaatimia valmistelutöitä jo ennen klo 17. Huoltoikkunan aikana sivustoilla voi esiintyä lyhyitä katkoja tai hitautta. Useimmilla sivustoilla päivitys ei näy käyttäjille lainkaan.
php2shell Schwachstelle in PHP gefährdet viele Projekte (WordPress, Drupal, ...). Bald soll es PHP-Updates geben. Hoffen wir, dass die Hoster die schnell installieren.
We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.
🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.
Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases
These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.
PHP has released security updates and recommends upgrading immediately.
Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/
#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. While the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.
https://vulnerability.circl.lu/bundle/bba240d0-7dfe-4f4f-94be-d6b640ddbc0e
Important #CVE vulnerabilities affecting #PHP: https://cert.europa.eu/publications/security-advisories/2026-018/
php8.4 for #Debian has been updated today to 8.4.27:
```
php8.4 (8.4.27-1~deb13u1) trixie-security; urgency=high
* New upstream version 8.4.27
+ (CVE-2026-109618, CVE-2026-109619): Avoid state corruption via
bailout.
-- Ondřej Surý <ondrej@debian.org> Wed, 21 Oct 2026 09:53:46 +0200
```
And my personal server quickly updated with just a simple: apt update && apt upgrade
Thanks @ondrej!!
🔧 Dočasně vypínáme podporu přes FreeScout (helpdesk.oscloud.cz) kvůli kritické chybě v PHP. Znovu ji zapneme po aplikování opravy.
⚠️ Kritická zranitelnost v PHP, co to znamená pro OSCloud
PHP tým oznámil dvě kritické chyby (CVE-2026-109618 a CVE-2026-109619, obě CVSS 9.2). Mohou umožnit spuštění cizího kódu na serveru bez přihlášení. Oprava vychází dnes v 16:00 SEČ/CEST. Podle hlášení bezpečnostních firem už probíhají první útoky.
Kterých služeb se to týká:
• Nextcloud, WordPress, Pixelfed, FreeScout, a další aplikace postavené na PHP
• LAMP weby zákazníků (Apache + PHP), včetně těch, kde zatím běží jen úvodní stránka
Kterých ne:
• Mastodon, Matrix, PeerTube, Gitea (PHP nepoužívají)
• Weby a úložiště na statických souborech (Surfer)
Co děláme:
• FreeScout jsme vypnuli
• Další PHP aplikace a LAMP weby budeme vypínat postupně a vždy o tom budeme informovat zde. Počítejte s tím, že dočasně vypneme i Nextcloud, a to do vydání a nasazení opravy
• Jakmile budou dostupné opravené verze aplikací, nasadíme je co nejdřív
• Před vypnutím a updaty děláme zálohy
Co to znamená pro vás:
• Podpora přes FreeScout je do opravy nedostupná
• Nextcloud, LAMP weby a další PHP služby mohou být dnes nedostupné
• Pokud by se při updatu něco pokazilo, vracíme se ze zálohy maximálně 12 hodin zpět
Opravu nelze řešit pluginy ani updatem WordPressu, musí přijít nové PHP v rámci aktualizace aplikace. Pokud provozujete vlastní PHP web mimo OSCloud, aktualizujte PHP hned, jak vyjde oprava.
Děkujeme za trpělivost. Stav budeme průběžně aktualizovat v tomto vlákně.
All affected users must patch against php2shell (CVE-2026-109618 / CVE-2026-109619). Due to the nature of some of the primitives involved, ASLR is not effective and arbitrary code execution/reuse/filesystem-level execution isn't a necessary component of exploitation in this case.
RE: https://phpc.social/@Girgias/117476477429221001
Re: PHP CVE-2026-109618 & CVE-2026-109619
php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available | Ubuntu https://ubuntu.com//blog/php2shell-vulnerability-fixes-available
PHP : deux failles critiques ont fuité avant l’heure, un correctif d’urgence arrive ce 21 octobre ! https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP
PHP has released emergency updates for two severe runtime vulnerabilities named PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2.
The flaws affect nearly all PHP versions back to PHP 5.4.
Researchers noted that AI assisted in turning old primitives into working exploits, while Cloudflare observed early attack attempts before patches shipped.
Fixes are included in versions 8.5.12, 8.4.27, 8.3.36…
https://en.hacks.gr/epeigoyses-enimeroseis-asfaleias-gia-tin-php-logo-sovaron-kenon/
PHP2SH-Bug
Scheint so, dass der MIME-Parser/-Splitter bei Uploads bei PHP kapott ist.
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
Und nein, es muss kein Upload-Formular existieren - es reicht schon, den passenden Exploit an +irgendeine+ PHP-Seite zu schicken. Die muss vmtl. nicht mal existieren, weil der Parser da schon in Aktion trat (unklar, weiß da wer mehr?)?
Helfen dürfte, alles zu sperren, was im "Content:"-Header irgendwas mit "multipart* hat.
1/2
#php #php2shell
I've temporarily blocked connections to Instafops.net and a few other sites that I host that use PHP. I've put up 503 pages and a 307 Redirect on the impacted websites.
The WordPress sites will probably be back tomorrow, Instafops may take a few days depending on docker image updates.
Apologies for any inconvenience this may cause.
Vorabinformation: Kritische Sicherheitslücken in PHP (CVE-2026-109618, CVE-2026-109619)
Das offizielle Sicherheitsupdate wird heute, am 21. Oktober 2026, um 14:00 UTC (16:00 Uhr MESZ) veröffentlicht.
Heute ist Patchday 😮
looks like some PHP RCE (CVE-2026-109618 / CVE-2026-109619 / PHP-UP-2026) deets started to drop.
as a LAMP shared webhoster we're obviously Very Excited™
Updates to Nextcloud package to fix CVE-2026-109618 and CVE-2026-109619 are out. Please update ASAP.
PHP ships an emergency security release today at 14:00 UTC. It fixes two critical bugs in PHP core (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2). The details leaked one day before the embargo ended.
Only PHP 8.2 and later get the fix. If you still have a PHP 7 box somewhere, today is a good day to find it.
My notes on what is confirmed and what to do:
https://www.abgeo.dev/blog/php2shell-critical-php-rce/
Die zentralen Websites der Uni Freiburg sind vom Netz genommen worden. #PHP
Kritisches PHP-Sicherheitsproblem: Websites offline
Sogar das BSI hat schon eine dringende Warnung veröffentlicht. Etwas hilfreicher ist der Text von Brian Krebs. Die besten und vor allem aktuellen Informationen gibt es beim SANS-ISC.
Beim jetzigen Kenntnisstand stellt sich die Lage so dar: In der FOSS Programmiersprache PHP wurden zwei Sicherheitslücken gefunden, die jetzt die Nummern CVE-2026-109618 und CVE-2026-109619 erhalten haben. Die zugrunde liegenden Schwachstellen existieren schon seit der Steinzeit, aber bisher war ihre eventuelle Ausnutzung so kompliziert, dass sie keine Gefahr darstellten. Mit Auftreten der KI hat sich das geändert. ... Weiterlesen:
#0day #cms #exploits #KI #provider #sicherheit #vorbeugen #wissen
🚨 Critical Alert from Karen IT
Two critical unauthenticated RCE vulnerabilities in PHP (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) have leaked early.
Do not delay.
🚨 تنبيه حرج
ثغرتان حرجتان في PHP تسمحان بتنفيذ أكواد عن بُعد بدون مصادقة (CVE-2026-109618 و CVE-2026-109619، CVSS 9.2) تم تسريبهما مبكراً.
لا تتأخروا.
#PHP #ثغرات #أمن_السيبراني #PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ZeroDay #PatchNow #CyberSecurity #RCE #CVE
Le #PHP est une langage de nombreuses applications Web utilisées dans les domaines de #SHS (Wordpress, SPIP, etc.), de nombreux sites Web sont donc concernés. Appliquez bien vos mises à jour ! https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/
🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619
PoC: https://github.com/ikow/php2shell-poc
The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.
CVSS: 9.2 Critical
Affected: PHP 5.4.0 through 8.5.11
Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12
The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.
The php2shell fix is out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Two critical bugs (CVSS 9.2), both remote code execution without authentication. mod_php has the highest risk, but PHP-FPM and other SAPIs are affected too. There are source backports for 7.4, 8.0 and 8.1.
Update, then do a full restart, not a reload.
Advisory: https://www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Updates to Wordpress, FreeScout packages to fix CVE-2026-109618 and CVE-2026-109619 are out. Please update ASAP.
A PHP security release on Oct 21 fixes two CVSS 9.2 flaws, CVE-2026-109618 and CVE-2026-109619, leaked as remote code execution bugs.
#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ZeroDay #PatchNow #CyberSecurity
PHP-UP-2026 https://jackalsyn.com/posts/php-up-2026.html
PHP session.upload_progress Use After Free / CVE-2026-109618 / CVE-2026-109619 / CVSS scores of 9.2 https://cert.europa.eu/publications/security-advisories/2026-018/
Alerte générale dans le monde #PHP :
“Upcoming Critical PHP Security Release” https://www.php.net/archive/2026.php#2026-10-20-1 et https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/
Um 12 Uhr UTC haben wir heute alle PHP Instanzen abgeschaltet. Jetzt warten wir auf die Veröffentlichung der PHP-Fixes für CVE-2026-109618 und CVE-2026-109619. Eine erneute Freischaltung der PHP Instanzen wird nicht vor 16 Uhr UTC erwartet. #hosting #security #php2shell
🚨 If you run PHP (like most of the internet does), this one can’t wait: #PHP2Shell = 2 critical RCE flaws in PHP core leaked before the patch, with live attacks already reported.
Because CVE-2026-109618 & CVE-2026-109619 sit in PHP itself, every app on a vulnerable PHP version is exposed, no matter what runs on top.
That’s why we’re building detection in our Network Scanner + an exploit module in Sniper as you’re reading this. Stay tuned for the launch announcement!
What to do now:
Inventory every PHP install, including control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
Patch as soon as PHP’s release is out, then restart PHP-FPM or your web server
On PHP 8.1 or older? No fix is coming. Upgrade, or take those systems off the internet
Alert on PHP processes spawning shells, interpreters, or download tools
#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking
Faille #PHP:
https://loud-technology.com/insight/faille-rce-php-cve-2026-109618-cve-2026-109619/
"Toutes les installations PHP qui servent des requêtes web sont concernées : PHP-FPM, Apache mod_php, php-cgi, FrankenPHP et LiteSpeed.
Le risque est maximal avec (Apache) mod_php, pour lequel un exploit fonctionne avant même l’exécution du code applicatif.
Selon l’équipe sécurité de PHP, aucune configuration ne remplace la mise à jour."
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.
PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.
Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
OpenAI udostępniło narzędzie (+skill) do weryfikacji, czy dany serwer ma podatną wersję PHP (CVE-2026-109618 + CVE-2026-109619).
Najprościej wywołać:
node phpcheck.js --local
Lokalnie wykrywa OK, ale zdalnie raczej jest bezużyteczne, bo czyta nagłówki HTTP w celu wykrycia wersji PHP, ale kto w obecnych czasach to eksponuje? 🤷♂️
Well, so far I have not been able to obtain PHP updates for Fedora 42, 43, and 44.
I am using this as a script:
#!/bin/bash
sudo dnf clean all
sudo dnf check-update php
sudo dnf update php\*
sudo dnf update
sudo systemctl restart php-fpm
# If using Apache:
sudo systemctl restart httpd
# If using Nginx:
# sudo systemctl restart nginx
rpm -q --changelog php-cli | grep -E "CVE-2026-109618|CVE-2026-109619"
#PHP CVE-2026-109618 and CVE-2026-109619: What you should do now - Vincent Schmalbach
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
La faille nommée « php2shell » regroupant 2 vulnérabilités critiques PHP (CVE-2026-109618 et CVE-2026-109619) est bien en cours de correction ou mitigation sur les serveurs que nous infogérons. Plus d'informations sur https://www.php.net/index.php#2026-10-20-1 et https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC #php2shell
@php vuln is up:
https://www.php.net/archive/2026.php#2026-10-21-5
https://www.php.net/ChangeLog-8.php#8.5.12
CVE-2026-109618 CVE-2026-109619
The PHP security team has released the patch for CVE-2026-109618 and CVE-2026-109619. Our team is now updating Passbolt Cloud and the self-hosted images (Docker, OVA, DigitalOcean). Passbolt Cloud will be restored once the update is deployed and verified.
Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
Wenn statt Eurer Webseite grad das hier auftaucht,
wird im besten Fall nur deren Server mit dem richtigen Patch (Update) versehen
CVE-2026-109618
CVE-2026-109619
bzw
GHSA-w8hw-w9fx-j79w,
GHSA-6wmf-4rv5-p3rp
watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.
https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
Security advisory: patches for #PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
PHP maintainers have announced upcoming updates for two high-severity vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying a severity score of 9.2.
Researchers at watchTowr have confirmed the findings.
Reports also indicate the existence of a 'PHP2Shell' tool purportedly capable of exploiting these flaws against platforms like WordPress, Joomla, and Drupal.
The issues appear to impact PHP versions d…
https://en.hacks.gr/krisimi-proeidopoiisi-gia-tin-php-erchontai-amesa-enimeroseis-asfaleias/
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, could allow unauthenticated remote code execution, The Hacker News reports. Details of the flaws leaked ahead of disclosure, and PHP shipped an out-of-cycle emergency security release on October 21 to address them. https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web
PHP2Shell exposes two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619. Learn the risks, affected versions, mitigations and patching stepshttps://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/
Heutiger Tag zeigt ggf. mal, warum auf (End of Life) EOL achten bei #PHP Versionen, MySQL & Co doch sinnvoll ist. Ist ja immer Kostenfrage/Debatte, aber inzwischen schreibt auch DSGVO "aktuellen technischen Stand" (mit vertretbarem Aufwand) vor. There is no glory in prevention. 🫣
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
Details about two critical-severity PHP vulnerabilities, dubbed PHP2Shell, have leaked online before the planned coordinated disclosure and release of official patches.
PHP has urged defenders to prepare to apply patches as soon as they become available for the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, which could enable remote code execution.
Oh my!
I’m curious about this. I wonder if this is something… useful?
⚠️ Vorsichtsmaßnahme: Verschiedene Webseiten und zentrale Webanwendungen vorübergehend abgeschaltet.
Aufgrund kurzfristig bekannt gewordener Sicherheitslücken in der weit verbreiteten Programmiersprache PHP müssen wir am heutigen Mittwoch, 21. Oktober 2026, vorsorglich verschiedene Websites und zentrale Dienste der Universität Freiburg abschalten, um unsere IT-Systeme und Daten zu schützen. Verschiedene Angebote werden daher vorübergehend nicht erreichbar sein.
Die Sicherheitslücken betreffen grundsätzlich alle Einrichtungen und Organisationen weltweit, die PHP-basierte Systeme einsetzen. Die PHP Foundation hat für heute Nachmittag Sicherheitsupdates angekündigt, mit denen die Schwachstellen behoben werden sollen. Sobald diese verfügbar sind, wird das Rechenzentrum der Universität die Updates einspielen und die Dienste überprüfen, damit die betroffenen Angebote schnellstmöglich wieder sicher bereitgestellt werden können.
Welche Websites und Webdienste betroffen sind und wann sie wieder zur Verfügung stehen, erfahren Sie auf dieser Seite, die wir regelmäßig aktualisieren: https://www.rz.uni-freiburg.de/de/rz/aktuell/stoerungen/2026-10-21-10-39-massnahme-im-zusammenhang-mit-der-kritischen-schwachstelle-php-cve-2026-109618-und-cve-2026-109619
I follow the updates on the status :
https://loud-technology.com/insight/faille-rce-php-cve-2026-109618-cve-2026-109619/
Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.
PHP2Shell (CVE-2026-109618, CVE-2026-109619): Zwei kritische RCE-Lücken in PHP und was getan werden muss
Wir werden das laufend aktualisieren ...
OK, sorted.
If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619
Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)
In the meantime, I've pushed to my registries
* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump
Should be drop-in replacements
If you use pfSense, you can run a command to force an update for the php issue. Granted this is a small vector of attack, as your webgui should be secure.
Warning though, it will kill any wireguard connections for a bit, as there is also a wireguard update.
2/2 - Critical PHP Vulnerabilities
"The PHP Foundation detailed the two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—which impact 'all PHP installations serving web requests' going back to PHP version 5, released in July 2004. However, only PHP 8.2 and newer are still supported and will receive patches, according to the alert. The PHP Foundation noted...ubiquitous and foundational web layers like PHP can persist forgotten and un-updated in historic internet infrastructure."
Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:
The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Lets face it, PHP Enthusisasts always kinda are dorks. Kinda.
Instagram: @programmersarealsohuman
#CVE-2026-109618, #CVE-2026-109619 #DEVSECOPS #INFOSEC
PHP-Sicherheitslücke CVE-2026-109618 und CVE-2026-109619: @lmz empfiehlt Abschaltung von Nextclouds. Verständlich, aber für digitale Schule eine Katastrophe.
@univention, @Karlitschek und @lmz: Bis wann können wir hoffen, dass Patch da ist und wir NextCloud wieder online nehmen können? Wäre echt wichtig, dass das schnell klappt!
#eduBW
cc: @KM_BW
LMZ: https://docs.meine-schulplattform.de/xwiki/bin/view/Aktuelles%20und%20Serviceinformationen/21.10.2026%3A%20Sicherheitswarnung%20PHP%20%E2%80%93%20Ma%C3%9Fnahmen%20dringend%20empfohlen/
PHP fixed two remote code execution flaws today, CVE-2026-109618 and
CVE-2026-109619. Anything serving PHP is affected, whatever sits on top of it.
Two steps, and the second is missing from most of the advice going round:
1. Update PHP. 8.5.12, 8.4.27, 8.3.36, 8.2.35, or your distro's backport.
2. Restart PHP. A pool loads its binary once and serves from it until it
restarts, so the fix on disk reaches nothing already running.
PHP 8.1 is past end of life and gets no fix. Move those sites.
📰 Critical PHP2Shell RCE Flaws Leaked Ahead of Coordinated Patch
🚨 CRITICAL: Two RCE flaws in PHP dubbed "PHP2Shell" (CVE-2026-109618, CVE-2026-109619) were leaked before patches. Affects PHP 5.4+. Active exploitation is confirmed. Prepare for emergency patching now! #PHP #RCE #CyberSecurity
Bluesky
Overview
Description
Statistics
- 9 Posts
- 516 Interactions
Fediverse
"CVE-2026-99999" is the fakest sounding CVE name. That is like Hideo Kojima or Kotaro Uchikoshi had just learned what a "CVE" is and decided to write a plot point about a macguffin mega-CVE that is going to cause enormous problems for the protagonists
#hugops to pretty much everyone in infosec and ops this week. At least my fedi feed is equally full of humor as it is of valuable details.
It feels like CVE-2026-99999 was a year ago (and don't forget to patch Linux kernels for it amid everything else going on).
🚨 PwnEscape (CVE-2026-99999), a critical Linux kernel flaw, could let malicious VMs escape KVM isolation and compromise hosts. Admins should patch and plan for a reboot; researchers warn exploits may emerge within weeks. 🔒 #Linux #Cybersecurity https://www.heise.de/en/news/PwnEscape-Critical-Linux-kernel-flaw-allows-VM-escape-11492399.html
It is disappointing that #Ubuntu doesn't have patched kernel packages and live patches available yet for #CVE-2026-99999 (PwnEscape). This vulnerability isn't just about VM break-out, it's also a potential kernel exploit for anything with certain capabilities, including many types of containers. This is of particular concern as composed with some of the other vulnerabilities this week (eg, attacks chaining from a PHP compromise to then break-out out of their Docker container).
Too many pessimists among our system administrators and software engineers regarding CVE-2026-99999.
Look on the bright side! At least you know it's the last CVE of the year, and you can relax.
#CVE #PHP #four #TLS #CVE202699999 #sarcasm #sysadmin #ReplyGuy #DontReplyGuyMe
So I checked the critical Linux IPv4 stack CVE-2026-99999 (https://nvd.nist.gov/vuln/detail/cve-2026-99999) and I find the the information as attached to which version is affected.
Besides it is an exploit to break out of VMs, I run my Linux machines on 7.2.11 currently. Doesn't that information mean this version isn't affected by the CVE?
(CW Alt text might be screen reader unfriendly)
Overview
Description
Statistics
- 5 Posts
- 148 Interactions
Fediverse
SECURITY ADVISORY: musl libc up through 1.2.6 (present version) is affected by integer overflows in regcomp (regular expression handling) leading to insufficient allocation of heap-based buffers for the compiled regex data structures.
CVE-2026-107891 has been assigned for this issue.
As an issue that can lead to writes outside of an allocated object, overflowing into other objects on the heap, CVE-2026-107891 should be taken with appropriate seriousness.
However, as far as we know at this time, without concurrent accesses from another thread to objects which might be stomped during regcomp, or unsafe SIGSEGV handler code, a predictable crash should happen before any further code runs that could use the clobbered objects in a way yielding control over the flow of execution to an attacker.
Bluesky
Overview
Description
Statistics
- 6 Posts
- 38 Interactions
Fediverse
Oh. My. Bob. It is a hella day to be in #infosec, I tell you what.
#Gitlab has a CVSS 10! and released critical patch updates on October 21, 2026, addressing multiple severe vulnerabilities including an unauthenticated Remote Code Execution (#RCE) flaw.
The patches cover GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
The update fixes CVE-2026-110264, a CVSS 10.0 integer overflow in the regular expression compiler that allows unauthenticated code execution across all self-managed versions dating back to 7.0 (2014).
The release also remediated 10 additional security issues, including cache poisoning in OAuth/OIDC endpoints (told you it was problematic).
Administrators of self-managed GitLab instances are strongly advised to upgrade immediately, as GitLab.com and GitLab Dedicated tenants already have the fixes applied.
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
Apply the GitLab critical patch release to fix 12 GitLab vulnerabilities, including 10.0 CVSS RCE flaw CVE-2026-110264 and CVE-2026-15723.
#GitLab #CVE2026110264 #DevSecOps #RCE #Cybersecurity #Vulnerability #InfoSec
Bluesky
Overview
Description
Statistics
- 8 Posts
- 27 Interactions
Fediverse
Node.js Brotli decoder out-of-bounds write permits remote code execution
(CVE-2026-111497) - (high)
Why nobody is freaking out about this one?
The Node.js security release fixes 10 flaws, including a Brotli remote code execution bug, CVE-2026-111497. Update to 26.12.1, 24.22.1 or 22.23.4.
#NodeJS #CVE2026111497 #CVE2026105483 #CVE2026106069 #RemoteCodeExecution #TLS #JavaScript #CyberSecurity
Bluesky
Overview
Description
Statistics
- 3 Posts
- 133 Interactions
Fediverse
> TLS certificate hostname bypass when the IP is written fullwidth digits (CVE-2026-105483) - (high)
what a week
i have to look at the four high severity CVEs in this latest node release... one is fairly easy to understand (dns.resolve uses NUL-truncated name), two regarding TLS hostname validation bypass, and an OOB write in the brotli decoder
The Node.js security release fixes 10 flaws, including a Brotli remote code execution bug, CVE-2026-111497. Update to 26.12.1, 24.22.1 or 22.23.4.
#NodeJS #CVE2026111497 #CVE2026105483 #CVE2026106069 #RemoteCodeExecution #TLS #JavaScript #CyberSecurity
Overview
Description
Statistics
- 9 Posts
- 4 Interactions
Fediverse
Plex Media Server is being widely exploited: a four-bug chain gives remote code execution on servers older than 1.43.3.10861. CISA added it to KEV Oct 20. Update now and check the Codecs folder.
Also: PAN-OS GlobalProtect CVE-2026-0257 (ransomware, patch now), and EOL D-Link NAS and UniFi Video boxes hijacked for bandwidth. Retire them.
Free Wednesday email:
https://patchorpass.beehiiv.com/?utm_source=mastodon&utm_medium=social&utm_campaign=issue1
Palo Alto Networks has confirmed ongoing exploitation of CVE-2026-0257 by ransomware groups.
The flaw affects PAN-OS and Prisma Access, allowing attackers to bypass multi-factor authentication and create unauthorised VPN connections.
The company released a fix in May 2026.
Qilin and INC have been identified as responsible for attacks; reported activity also includes network reconnaissance and movement across networks.
T…
[1/2] Unit 42 aggiorna su PAN-OS CVE-2026-0257 (auth bypass GlobalProtect, patch di maggio, in CISA KEV): Qilin (Spikey Scorpius) e INC (Tarnished Scorpius) lo usano per stabilire sessioni VPN aggirando l'MFA. Poi tool RMM dual-use, lateral movement via RDP/SMB e tooling per credential harvesting, exfiltration e deploy ransomware.
[2/2] Caso notevole: dal gateway VPN a vCenter, disattivazione di execInstalledOnly sugli ESXi e dump offline delle credenziali dal VMDK di un domain controller, che aggira l'EDR in-guest. Unit 42: solo una piccola parte dei device sondati ha aperto sessioni VPN. Azioni: patch, limitare l'esposizione delle management interface, hunt su eventi gateway-connected anomali (IP e host ID nell'advisory), IR se positivi. https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ #cybersecurity #ransomware
CVE-2026-0257 affects PAN-OS GlobalProtect portals and gateways, potentially allowing attackers to bypass security restrictions and establish an unauthorized VPN connection. https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226
Bluesky
Overview
- Oracle Corporation
- Oracle Java SE
Description
Statistics
- 3 Posts
- 38 Interactions
Fediverse
Aaaaand another. Oracle drops 9.1 in multiple JVM.
https://www.oracle.com/security-alerts/alert-cve-2026-91403.htm
Never mind. This is just the Java trust store update for the other bullshit going on. You knew Java had its own trust store right?
Man, PHP has been getting its shit kicked in today. Well, at least the other language I grew up on is doing fine, right Java?
...Java?
sev:CRIT in Java really is the best way this week could continue on course.
https://www.cve.org/CVERecord?id=CVE-2026-91403
sev:CRIT 9.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Overview
- Go standard library
- crypto/x509
- crypto/x509
Description
Statistics
- 5 Posts