Fast Facts
- Update, 10/21/2026, 9:55 a.m.: PHP released fixes for supported branches 8.2–8.5: versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- The two “php2shell” flaws, CVE-2026-109618 and CVE-2026-109619, are rated critical (CVSS 9.2) and could allow remote code execution.
- Cloudflare reported early attacks; exploit demonstrations and unverified code are circulating.
- Exposure could be widespread: researchers estimate over 1.3 million internet-facing hosts are vulnerable. Patch promptly; isolate exposed applications if you can’t update immediately.
The Issue
The PHP project has released emergency fixes for two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619. The patches cover supported PHP branches 8.2 through 8.5: versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The unscheduled release followed an online leak of exploit details and reports of early attacks. Cloudflare CTO Dane Knecht said the company had seen attacks and was updating its defenses.
The flaws could let attackers run code on vulnerable servers, putting websites and services built on PHP—including WordPress, Drupal, Joomla, and Laravel—at risk. Exposure may be extensive, though the full technical details and affected-version list were not yet confirmed in the original report. CERT-EU warned that versions as far back as PHP 5 could be affected, while researchers estimated that more than a million internet-facing hosts might be vulnerable. CyberScoop reported the story and its October 21 update, which confirmed that the patches had shipped.
Potential Risks
The PHP vulnerability warning could affect any business that runs a PHP-powered website or application, directly or through a vendor. If systems remain unpatched, attackers may exploit them to access sensitive data, disrupt services, or install malicious software. As a result, even a brief outage can delay sales and operations. A breach can also trigger investigation costs, regulatory penalties, customer losses, and lasting reputational damage. Therefore, businesses should identify affected systems, apply verified security updates promptly, and confirm that third-party providers have done the same.
Possible Action Plan
Timely remediation reduces the window attackers can exploit and supports NIST CSF goals for managing risk and protecting critical services.
Response Steps
- Confirm exposure: Check PHP’s official security advisories for affected versions and required fixes; inventory PHP versions across servers, containers, and applications.
- Patch promptly: Install the vendor-recommended PHP update for each affected, supported branch. Test first where feasible, then deploy without unnecessary delay.
- Limit interim risk: Until patching is complete, restrict public access to vulnerable services where possible, disable exposed components that are not essential, and apply relevant WAF rules as a temporary safeguard.
- Verify and monitor: Restart PHP-FPM or other relevant services, confirm the patched version is running, and review logs and alerts for suspicious activity.
- Recover safely: Keep backups and a rollback plan; document remediation and investigate any signs of compromise.
Stay Ahead in Cybersecurity
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
