PHP warns of two critical RCE flaws, emergency patches due October 21

A critical remote code execution vulnerability in PHP, discovered by OpenAI's GPT 5.6-Sol, was known to a small team of maintainers for two years prior to public disclosure. The flaw, rooted in PHP's error handling, allows attackers to execute arbitrary code on affected servers, with 73% of PHP installations running unsupported versions.

A China-linked hacking group exploited PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and the Fragnesia kernel bug to gain root access on Palo Alto Networks firewalls. Palo Alto Networks has confirmed the attacks and released patches for affected PAN-OS versions, urging customers to restrict management interface access.

Cybersecurity firms report limited exploitation of two recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as "PHP2Shell." One firm alleges a Chinese threat actor used these bugs, chained with another firewall exploit, to compromise U.S. government-affiliated servers, gaining root access on 24 firewalls.

CISA has issued a warning to federal agencies regarding a high-severity Linux kernel privilege escalation bug, CVE-2026-46300 (Fragnesia), which is being actively exploited. Attackers are chaining this vulnerability with two critical PHP flaws (PHP2Shell) to deploy webshells and gain root access on unpatched systems. Federal agencies are mandated to patch these vulnerabilities by specific deadlines.

Palo Alto Networks issued a warning that threat actors are actively exploiting recently patched PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) in internet-exposed management interfaces. These flaws allow unauthenticated remote code execution, and have been observed chained with a Linux kernel bug (CVE-2026-46300) to compromise servers, including some in a U.S. government-affiliated environment.

Tomer Schwartz, CTO at Wiz, discussed the recent critical PHP vulnerabilities (PHP2Shell) and the challenges of patching systems. He also addressed how AI could accelerate the discovery and exploitation of new vulnerabilities, suggesting manual patching methods will become unsustainable.

A suspected China-nexus threat actor used PHP2Shell vulnerabilities and a Linux kernel exploit to compromise 25 servers, including three in a U.S. government-affiliated network. The attack involved custom exploits and AI-assisted tooling, leading to credential extraction and directory enumeration within the breached environments.

Eclypsium's October InfraTrust Pulse report identifies 16 actively exploited vulnerabilities in critical network infrastructure, including "PHP2Shell" flaws affecting management interfaces. Many network appliances use embedded PHP, requiring vendors to release firmware updates for patches, which leaves devices vulnerable while awaiting updates.

The PHP2Shell vulnerabilities, discovered with AI assistance and exploited before patches were widely applied, demonstrate the increasing speed of exploitation versus remediation. This situation emphasizes that reducing an attacker's reach after initial compromise, rather than solely focusing on patching speed, is critical for enterprise security.

A China-linked threat actor exploited PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and a Linux kernel privilege escalation bug (CVE-2026-46300) to gain root access to firewalls and deploy webshells. The attackers targeted 25 internet-facing firewalls, including two in a US government-affiliated environment, to establish persistent access and compromise internal systems.

Five days after disclosure, 93.6% of systems vulnerable to PHP2Shell (CVE-2026-109618 and CVE-2026-109619) remain unpatched, according to Ox security. This lack of remediation is occurring as attacks exploiting these vulnerabilities, which have a CVSS score of 9.2, are increasing in the wild.

Multiple critical security incidents involving PHP, Node.js, GitLab, and LiteLLM occurred between October 16-23, 2026, with patches released on October 21. These events underscore the increasing speed at which vulnerabilities are exploited, often within hours of disclosure, and expose the challenges organizations face in quickly identifying affected systems due to inadequate asset inventories.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of two critical PHP vulnerabilities, ordering federal agencies to patch systems within three days. These bugs, which allow remote system compromise, affect approximately 70% of web-facing servers and were previously considered unexploitable until researchers used an AI model to find an exploit method.

Wiz Research has been monitoring exploitation attempts for two recently disclosed PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), dubbed PHP2Shell. While no successful public exploits have been observed, remediation efforts have led to a 67% decrease in vulnerable internet-exposed machines since disclosure.

Cloudflare launched a PHP Capture the Flag (CTF) challenge via its Bug Bounty program to test its Web Application Firewall (WAF) against recent PHP vulnerabilities. The challenge invites security researchers to bypass WAF protections and exploit a vulnerable PHP installation to recover a flag, aiming to collect real-world data to strengthen defenses.

CISA has added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), to its Known Exploited Vulnerabilities Catalog, mandating federal agencies to patch by Thursday. These flaws allow unprivileged threat actors to achieve remote code execution on unpatched systems, posing significant risks given PHP's widespread use across websites.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog due to active exploitation. These flaws enable unauthenticated remote code execution and affect millions of PHP services, requiring urgent patching by federal agencies and other organizations.

PHP rebuilt its official Windows packages for versions 8.2 through 8.5 to fix CVE-2026-111497, a critical memory corruption and potential code execution flaw in the included Brotli compression library. This update addresses a vulnerability that could be exploited via the cURL extension when automatic decompression is enabled, impacting applications using libraries like Guzzle that enable this setting by default.

Major industrial vendors like Siemens, Schneider Electric, ABB, and Rockwell Automation are assessing or addressing the impact of PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on their industrial and operational technology (OT) products. These critical flaws in the PHP engine allow unauthenticated remote code execution, leading to advisories and patch releases for affected systems.

The past week saw a surge in critical remote code execution (RCE) vulnerabilities, including PHP2Shell flaws, leading to widespread scanning and precautionary website shutdowns. Additionally, a software supply-chain attack occurred due to a leaked key, and a digital security firm exited the TLS certificate market after weak private keys were compromised, resulting in major browsers blocking affected certificates.

Attackers successfully exploited critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to execute shell commands on honeypot servers. This confirms unauthenticated remote code execution, moving beyond previous observations of probes and crashes, and indicates active exploitation of the flaws.

The PHP Foundation, responsible for the PHP scripting language used by 71% of websites, employs only one full-time person and 14 part-time contractors. This understaffing contributed to a critical remote code execution vulnerability, PHP2Shell, remaining unaddressed for months despite being discovered in 2024, highlighting chronic underfunding in critical open-source projects.

Two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), are now confirmed to be actively exploited in the wild. This development indicates that attackers are successfully compromising Apache mod_php installations, leading to memory disclosure and command execution.

PHP released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 CVSS v4.0. These flaws, present in PHP versions since 5.4, were actively exploited four days before the patches were publicly available, leading to a collapsed coordinated disclosure.

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were discovered in PHP, allowing unauthenticated access to systems. The PHP Foundation released patches, leading to a coordinated industry effort to secure web-facing servers and prevent mass exploitation.

The PHP security team released mitigation steps for a new remote code execution vulnerability, CVE-2026-115560, which affects systems with specific non-default configurations and currently lacks a patch. This vulnerability requires an unusual combination of configuration and application code to be exploitable, and a full advisory and patch will be included in the next regular release cycle.

Critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, have been discovered in PHP, impacting most PHP builds. These flaws allow for remote code execution and memory disclosure, prompting an urgent global effort to apply patches released by the PHP Project.

Two new PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, led to government websites and public services across Europe going offline. These remote code execution (RCE) risks affect all PHP versions back to 5.4 and highlight the challenge of unsupported PHP versions in the face of accelerated CVE discovery due to AI.

Threat actors are attempting to exploit the recently patched PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to spread a Mirai botnet variant, though no successful in-the-wild compromises have been confirmed. A security firm has also developed an exploit that bypasses Address Space Layout Randomization (ASLR), indicating advanced exploitation capabilities are being developed for these critical remote code execution flaws.

IT administrators globally are working to patch critical security flaws in PHP, a widely used programming language for websites. The emergency response highlights the challenges of coordinating fixes across diverse systems and managing client concerns amid urgent security alerts.

PHP issued a warning about a new unpatched remote code execution vulnerability, CVE-2026-115560, two days after releasing emergency fixes for the PHP2Shell flaws. This new issue affects web applications with a specific, unusual configuration and PHP recommends disabling the 'session upload progress' feature as a temporary mitigation.

A consultant apologized on Hacker News for prematurely disclosing critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) before their embargo. The individual stated they were unaware of the embargo, having been misinformed by a contact, which contributed to early public knowledge of the flaws.

Threat actors are attempting to exploit PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a Mirai botnet variant named Potassium. These attempts aim for unauthenticated remote code execution, but successful exploitation has not yet been observed in the wild.

Multiple companies report increased exploitation attempts for two PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), but security experts state that most attempts are unsuccessful due to proof-of-concept limitations and real-world security protections like ASLR. The vulnerabilities, dubbed PHP2Shell, are proving difficult to exploit widely outside of lab conditions.

A critical vulnerability in the PHP programming language, which powers 70% of websites, has led to millions of exploitation attempts. The flaw allows attackers to take control of web servers and steal data, prompting governments and companies to take websites offline for patching.

European government websites went offline due to critical vulnerabilities in PHP, prompting the U.S. NSA to warn organizations to patch immediately or take servers offline. The vulnerabilities, dubbed "PHP2Shell," allow unauthenticated remote code execution, and their rapid exploitation is attributed to AI-augmented attacker capabilities.

Amazon reported that vulnerabilities in PHP, discovered with AI tools, were exploited four days before public disclosure and are now broadly exploited. The flaws, undetected for over a decade, prompted warnings from the NSA and UK authorities for organizations to update systems immediately.

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were found in PHP, leading some websites to temporarily shut down for patching. These flaws, discovered with AI assistance, highlight challenges in coordinated disclosure and the increasing pressure on open-source maintainers.

Two critical vulnerabilities, dubbed PHP2Shell, in the PHP programming language allowed unauthenticated attackers to execute malicious code, leading to widespread website shutdowns and emergency patches. The flaws were discovered by AI models, highlighting increasing pressure on open-source maintainers as AI accelerates vulnerability discovery.

Amazon Threat Intelligence reported that exploitation attempts for critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) began on October 17, four days before official patches were released on October 21. These remote code execution flaws are now being broadly exploited, though the success rate of these attacks on real-world systems is unclear.

Multiple tech vendors, cybersecurity firms, and government agencies have issued advisories and patches for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21 to address these flaws, with exploitation attempts detected before the official patch release.

Significant security vulnerabilities were discovered in PHP, a scripting language used by 70% of websites, allowing attackers direct access to file systems or databases. This led to many commercial and government websites being taken offline, as the NSA advised unpatched sites to go offline due to broad exploitation of the flaws.

OpenAI announced its AI model GPT-5.6 Sol identified critical security flaws in PHP, an open-source language used by 70% of the internet. These vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involve memory management and error handling, prompting the release of patched PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

Recent vulnerabilities in the PHP programming language prompted widespread website shutdowns as a precaution, despite the flaws being difficult to exploit manually. The incident highlights a new challenge in cybersecurity where AI could facilitate the exploitation of complex vulnerabilities, even before they are publicly known.

Threat actors started exploiting two critical PHP remote code execution (RCE) vulnerabilities, known as PHP2Shell, four days before patches were publicly available. This early exploitation, observed by Amazon and others, indicates that exploit information was acquired before official disclosure, leading to widespread attempts after patches were released.

Critical cyber-security flaws have been identified in the PHP programming language, which underpins a significant portion of the world's websites, including major platforms like WordPress and Wikipedia. Governments and companies are urgently working to apply fixes, as the vulnerabilities allow attackers to execute arbitrary code on web servers, potentially leading to data theft and network compromise.

Amazon's Threat Intelligence team detected an attempt to exploit newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service. This occurred four days before the vulnerabilities were publicly disclosed, indicating a threat actor acquired exploit information ahead of time.

Serious vulnerabilities in the PHP programming language, underpinning much of the internet, were discovered by AI, leading to a global cybersecurity alert. Governments and cybersecurity agencies are urging website operators to install an emergency fix or take platforms offline to prevent attackers from taking control of web servers and stealing sensitive data.

Two critical vulnerabilities, collectively named "PHP2Shell," were discovered in PHP, an open-source programming language widely used for websites and web applications. These flaws allow remote code execution, leading to urgent warnings from global governments and responses from tech giants like Google, OpenAI, and Amazon to mitigate potential attacks.

The PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively named PHP2Shell. AWS provides guidance on using AWS Web Application Firewall (WAF) to mitigate these vulnerabilities while organizations apply the necessary patches.

A critical vulnerability in PHP, used by nearly 70% of websites, led to temporary shutdowns of government and major websites globally. Security agencies issued urgent warnings, as the flaw could allow direct access to server file systems or databases, prompting a race to patch before widespread exploitation.

A recent PHP vulnerability, despite widespread concern and numerous proof-of-concept exploits, is not easily exploitable in vanilla PHP instances. Many alleged exploits generated by large language models (LLMs) do not function as claimed, indicating a misunderstanding of exploit complexity.

Amazon Threat Intelligence detected exploitation attempts of PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in its MadPot telemetry four days before their public disclosure. This incident highlights that exploitation can occur prior to official vulnerability announcements and that the time between patch release and working exploits is decreasing, partly due to AI-assisted analysis.

AI models, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, helped researchers uncover two critical memory-safety vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP. These flaws, collectively named PHP2Shell, affect all PHP releases from the past decade and could allow attackers to access sensitive data or execute malicious code on websites running on PHP, which powers approximately 70% of the web.

AWS is experiencing delays in patching two critical PHP Remote Code Execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in Amazon Linux 2023. This delay leaves users exposed to significant security risks, with no immediate ETA for a fix despite the issues being reported days ago.

Government websites in the EU and Canada were taken offline as a preventive measure following the discovery of critical vulnerabilities in PHP. The PHP Foundation issued a security release to patch these flaws, which could allow hackers to take control of systems running PHP.

Two critical vulnerabilities in the PHP programming language, present for approximately 20 years, were recently discovered by AI models from OpenAI and Wiz. These flaws allow for unauthenticated remote code execution, prompting major websites and government agencies to take their systems offline as a precautionary measure.

Multiple critical cybersecurity vulnerabilities were reported across several widely used technologies, including PHP, Node.js, LiteLLM, and an Indian certificate authority eMudhra. These issues range from remote code execution and information stealers to compromised private keys, prompting urgent updates and remediation efforts across the industry.

The U.S. National Security Agency issued a warning about two critical vulnerabilities in PHP, a server-side language powering 70% of websites, after OpenAI and Google's Wiz discovered them using AI. These flaws, present since PHP version 5 (2004), allow attackers to infiltrate server file systems or databases, necessitating immediate patching or website removal.

The PHP Foundation stated that two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, gained serious attention in August after an external review by AI companies. One bug, CVE-2026-109618, was identified in 2024 but a fix was delayed due to internal debates and concerns over compatibility and potential denial-of-service issues. These vulnerabilities are critical because they reside in core parts of PHP, affecting a large portion of the internet and leading to emergency patches and website shutdowns.

PHP released patches for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, affecting nearly all PHP versions. Exploitation attempts were observed in the wild around the time patches were released, posing a significant risk to unpatched PHP installations.

The PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical vulnerabilities that allow unauthenticated remote code execution. These fixes are crucial for servers running PHP, and users are advised to update immediately.

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in PHP, a scripting language used by over 70% of websites, have led to hundreds of sites being taken offline. These bugs, rated 9.2 out of 10, allow for remote code execution on unpatched systems, prompting urgent warnings from governments and cybersecurity firms.

The PHP security team released emergency patches for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These unauthenticated RCE flaws affect all PHP installations serving web requests and can lead to memory corruption, allowing attackers to execute code with web worker privileges.

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed in the core PHP language runtime, allowing unauthenticated remote code execution and memory disclosure. These flaws affect all PHP versions from 5.4 through 8.5.11 and have a CVSS base severity score of 9.2, requiring immediate updates to patched versions like PHP 8.5.12 or newer.

PHP released emergency updates to fix two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively named PHP2Shell. These flaws, rated 9.2 on CVSS v4.0, allow unauthenticated attackers to execute code on web servers running vulnerable PHP versions, impacting nearly all installations since PHP 5.4.

Cloudflare deployed Web Application Firewall (WAF) protections against two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as php2shell. These vulnerabilities affect PHP 5.4 and later, potentially leading to denial of service, remote code execution, and data exposure. Cloudflare's WAF protections were deployed ahead of public disclosure and utilize a new full transaction detection capability.

The PHP development team released PHP 8.2.35 to address two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These flaws could allow unauthenticated remote code execution, making immediate updates necessary for all PHP 8.2 users.

Two significant security vulnerabilities have been identified: one in the PHP programming language affecting major CMS platforms like WordPress and Drupal, and another involving compromised TLS certificates from eMudhra with extremely weak encryption. Both issues could lead to large-scale attacks and require immediate patching by site administrators.

Two critical PHP vulnerabilities, rated 9.2 out of 10, have no complete workaround before the official fix scheduled for October 21 at 14:00 UTC. Security firm GMO Flatt Security retracted its earlier suggestion of a `session.upload_progress.enabled=0` setting as a full mitigation, stating it is insufficient.

PHP released an out-of-cycle security update on October 21 to address two critical remote code execution (RCE) vulnerabilities, rated 9.2 on the CVSS v4.0 scale. These flaws, dubbed "php2shell" by researchers, affect supported PHP branches 8.2 through 8.5 and were disclosed ahead of schedule due to a leak.

Details on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with CVSS scores of 9.2, have been leaked online before official patches. These flaws could lead to remote code execution and affect all PHP versions from PHP 5 onwards, prompting urgent calls for immediate patching upon release.

PHP maintainers announced plans to release two emergency patches for vulnerabilities rated 9.2 out of 10, urging users to prepare for immediate upgrades. The announcement follows leaked details and a video of an exploit tool, PHP2Shell, demonstrating code execution on various web applications running PHP.

The PHP security team announced emergency security updates for October 21 to address two critical remote code execution (RCE) vulnerabilities, rated 9.2 CVSS v4.0. Information about these flaws, affecting PHP versions 5, 6, 7, and 8, reportedly leaked ahead of the scheduled disclosure, prompting the urgent release.