Technology and Scienceupdated 59m ago2 min read
Archive photo · 22 August 2009PHP Project Releases Patches For CVE-2026-109618 And CVE-2026-109619 After php2shell Attacks
2 Other2 Western Mainstream1 Asian2 Other source typesPhoto: Indrajit Das, CC BY-SA 3.0 · Cropped for layout
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated RCE. PHP released emergency patches around October 20–21 to fix the vulnerabilities.
PHP flaws spark patch rush
The PHP project released patches for two critical vulnerabilities that can allow unauthenticated remote code execution, sending organizations scrambling to update their systems or take websites offline. The PHP project said the fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and it tracked the flaws as CVE-2026-109618 and CVE-2026-109619.
The Cybersecurity and Infrastructure Security Agency urged organizations to patch the flaws, which it calls "php2shell," and to prioritize internet-facing systems. Cloudflare CEO Matthew Prince said, "In the 10 hours prior to the public announcement, we observed thousands of attempts to exploit it across our network," as the number of attempts rose to millions within hours.
Mitigation without a patch
The PHP security team shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. The PHP security team explained that the flaw tracked as CVE-2026-115560 can only be exploited when targeting systems "with an unusual combination of configuration and application code."
The PHP security team advised administrators to set session.upload_progress.enabled=0 until a security patch is available, adding, "If you applied it then, keep it in place and no further action is needed." Amazon Threat Intelligence said attackers began targeting the PHP2Shell vulnerabilities four days before security patches were released on Wednesday, and AWS chief information security officer CJ Moses said, "PHP2Shell is now seeing broad exploitation attempts in the wild,".
Who is at risk next
Kaspersky warned that nearly 70% of websites run PHP, and it said attackers could steal authentication tokens from server memory to access accounts without entering a password or a two-factor authentication code. Kaspersky also warned that a NAS or video surveillance system at home that uses a vulnerable version of PHP may be at risk, and it said attackers could copy, delete, or encrypt the files they can access.
The PHP project said all installations serving web requests are at risk, with the highest risk for those running Apache with mod_php, and it urged organizations to take PHP-based systems offline until they are patched if they cannot update. The DW report said the FBI’s cyber division warned that the vulnerabilities could allow malicious actors to remotely execute code in PHP, increasing the risk of confidential data and networks being compromised.