Skip to content
Emergency Patches Released for Critical PHP2Shell Vulnerabilities

Emergency Patches Released for Critical PHP2Shell Vulnerabilities

First seen 21 Oct 2026, 20:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 22:11 UTC
  • •Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed.
  • •Emergency patches are available for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
  • •Older PHP versions (8.1 and below) are not patched and remain vulnerable.

On October 21, 2026, the PHP Foundation released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. These vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Exploitation attempts have already been observed in the wild following premature disclosure of the vulnerabilities. Administrators are urged to update to fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 immediately. Older versions, specifically PHP 8.1 and below, will not receive official patches and are at higher risk. The vulnerabilities stem from flaws in PHP's memory management and error handling, allowing unauthenticated attackers to execute arbitrary code on affected servers. Security experts warn that the window for exploitation has narrowed significantly due to the rapid dissemination of vulnerability details.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-06-09
CVE-2024-4577 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-20
Vulnerability details leaked
Details of the vulnerabilities were prematurely disclosed online, prompting urgent action from PHP maintainers.
Simonwillison
2026-10-21
Emergency patches released
PHP Foundation released patches for CVE-2026-109618 and CVE-2026-109619, urging immediate updates.
Precursorsecurity
2026-10-21
Active exploitation observed
Cloudflare reported early attacks exploiting the vulnerabilities shortly after the patch release.
Cyberinsider
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (34)

Following this threat?

Track Debian and CVE-2024-4577 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (33)

1 / 4

Common questions

Which PHP versions are affected?
All PHP installations serving web requests, especially mod_php, PHP-FPM, and php-cgi, are affected. PHP 8.1 and below will not receive official patches.
What should I do immediately?
Update to the fixed PHP versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12 as soon as possible.
Is there confirmed exploitation in the wild?
Yes, early exploitation attempts have been reported by Cloudflare shortly after the vulnerabilities were disclosed.