Security3h ago6 sources
The PHP security team issued an out‑of‑cycle release at 14:00 UTC on October 21 fixing two remote code execution vulnerabilities rated 9.2 CVSS (CVE‑2026‑109618 and CVE‑2026‑109619), collectively called PHP2Shell. Amazon Web Services recorded exploitation attempts of these bugs four days earlier, and the flaws are being broadly exploited across the internet. The patches address the critical issues but no effective workaround was provided before the release.
Why it matters: Web developers and server operators must apply the patches immediately to stop active exploitation of high‑severity PHP RCE bugs.
