Cybersecurity
PHP releases patches for two critical RCE flaws
The PHP security team released fixes for two unauthenticated remote code execution flaws, warned that some deployments faced higher risk, and urged administrators to upgrade immediately.
- Researchers from Calif, Wiz and OpenAI found two unauthenticated remote code execution flaws that the PHP team grouped as PHP2Shell.
- The PHP security team released emergency patches for CVE-2026-109618 and CVE-2026-109619.
- PHP said the bugs affected installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
- The team told administrators to install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and said PHP 8.1 and older no longer received project updates.
- Before the release, Cloudflare CTO Dane Knecht said Cloudflare had already seen early attacks and had deployed WAF rules, while the UK National Cyber Security Centre told UK organisations to update systems or take them offline.
The PHP security team released emergency fixes for CVE-2026-109618 and CVE-2026-109619 after security researchers from Calif, Wiz and OpenAI found the flaws. The team grouped both issues under the PHP2Shell name.
PHP said the vulnerabilities affected installations that handled web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It said the greatest risk was on mod_php, where an unauthenticated request could succeed before application code ran.
The team told administrators to move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on supported 8.x systems. It also said PHP 8.1 and earlier no longer received project updates, although some distributors and LTS vendors could backport fixes.
Before the patches were issued, Cloudflare CTO Dane Knecht said his company had already seen early attack attempts and had pushed blocking rules for known methods. Gina Peter Banyard said the official patches were the only lasting defence, and the UK National Cyber Security Centre told UK organisations to update systems or take them offline until they were patched.
Named in this story
People
- Calif
- helped discover the flaws
- Dane Knecht
- Cloudflare CTO who confirmed early attacks
- Gina Peter Banyard
- PHP core developer who said the official patches were the only lasting defence
Companies
- Wiz
- its security researchers helped discover the flaws
- OpenAI
- its security researchers helped discover the flaws
- Cloudflare
- had deployed blocking rules and saw early attack attempts
Organisations
- PHP security team
- released the emergency patches and published mitigation advice
Governments and agencies
- UK National Cyber Security Centre
- warned UK organisations to update or take systems offline
Products and systems
- PHP2Shell
- collective name for the two vulnerabilities
- PHP
- the language and runtime affected by the flaws
How the source tells it
The article was mostly a straight security notice, but it used an urgent register through repeated calls to patch immediately and warnings about active attacks.
- urgency repeated deadlines and instructions to upgrade immediately
- alarm critical severity language and the warning that unauthenticated attacks could run before application code