Cloudways on X: "Today, the PHP Group disclosed critical Remote Code Execution (RCE ...

X • October 22, 2026

Cloudways @Cloudways Today, the PHP Group disclosed critical Remote Code Execution (RCE) vulnerabilities affecting PHP. Because PHP powers a significant of the web, including WordPress, Drupal, Laravel, and custom applications, we notified all customers this morning. To follow up on our notice on status.cloudways.com , we are implementing further latest interim configuration-level mitigations recommended by the PHP Group while preparing for a phased rollout of the official patches across our fleet. These interim measures provide an additional layer of protection while patch deployment is underway. For deprecated PHP versions, we are working with our ELTS partners to apply the appropriate security patches and maintain security coverage. We will further updates as the rollout progresses on our Status Page: status.cloudways.com Official PHP advisory: php.net/index.php#2026… 3:49 PM · Oct 21, 2026 · 2,327 Views 8

Tony Spencer @notsleepy Oct 21 Step it up fellas. Too slow. 1

Andrew Suroor Bonar @andrewbonar Oct 21 Is this a joke? You sent a pointing people back at the Status page not updated for 2.5 hours? This says nothing the platform outage. Console, API and support have been down since 13:35 UTC, the window ended at 15:05, and the status page you keep pointing to hasn’t 2

Pim Jenniskens @pimjenniskens Oct 21 Any updates on timelines? Are we talking minutes, hours, days, years? 5 hours since the patches released and still no proper information.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models. 785 sources 73

Extracted Entities

Cloudways on X: "Today, the PHP Group disclosed critical Remote Code Execution (RCE ...

The full story

Extracted Entities

Attack Types (1)

Domains (2)

MITRE ATT&CK (1)