Back www.csa.gov.sg

Al 2026 151

www.csa.gov.sg • October 24, 2026

Attackers can exploit multiple critical vulnerabilities in PHP to achieve unauthenticated remote code execution. Patch immediately.

Last Updated: 23 October 2026

Update as of 23 October 2026

CSA has published additional guidance for website owners, service providers, system administrators, and security teams: [TLP:CLEAR] PHP2Shell - Monitoring for related compromises [PDF, 418.32 KB] (opens in new tab) The guidance covers identifying vulnerable PHP installations and monitoring for potential exploitation attempts.

We continue to be aware of widespread exploitation attempts, and we urge organisations to take immediate action, prioritising internet-facing systems.

PHP is a widely used scripting language in many websites and web applications. Security updates have been released to address two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP, collectively known as PHP2Shell. Both vulnerabilities have a Common Vulnerability Scoring System (CVSS v4.0) score of 9.2 out of 10.

Successful exploitation of these vulnerabilities could result in the following:

CVE-2026-109618: An out-of-memory handling vulnerability that could allow an unauthenticated remote attacker to execute arbitrary code on affected systems.

CVE-2026-109619: A use-after-free vulnerability that could allow an unauthenticated remote attacker to execute arbitrary code on affected systems.

There have been reports of widespread exploitation attempts targeting these vulnerabilities, as well as the development of multiple proof-of-concept (PoC) exploits.

These vulnerabilities affect all versions of PHP.

Users and administrators of affected products are advised to update to the latest versions immediately. If an affected product cannot be immediately updated, refer to PHP's guidance available at (opens in new tab) for temporary measures to reduce exposure to specific attack paths.

Organisations are advised to identify systems running any version of PHP and apply the security updates, prioritising internet-facing systems. Organisations should further check whether PHP is installed on their web servers, including where it may be used by third-party applications or components, even if their primary websites do not use PHP.

Organisations should also continue to monitor PHP's official guidance for updates.

(opens in new tab)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models. 785 sources 73

Extracted Entities

Al 2026 151

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (1)

Platforms (1)