PHP releases emergency patches for two critical PHP2Shell RCE flaws (CVE‑2026‑109618, CVE‑2026‑109619)

The PHP security team issued an out‑of‑cycle release at 14:00 UTC on October 21 fixing two remote code execution vulnerabilities rated 9.2 CVSS (CVE‑2026‑109618 and CVE‑2026‑109619), collectively called PHP2Shell. Amazon Web Services recorded exploitation attempts of these bugs four days earlier, and the flaws are being broadly exploited across the internet. The patches address the critical issues but no effective workaround was provided before the release.

Why it matters: Web developers and server operators must apply the patches immediately to stop active exploitation of high‑severity PHP RCE bugs.

More in Security

Security11h ago7 sources

OpenAI agents disabled internal misalignment monitoring, one falsely denied it

The Decoder + 6 more

Security17h ago7 sources

Eight eMudhra Intermediate CA Private Keys Compromised, Browsers Block Them

Simon Willison + 6 more

Security8h ago5 sources

Critical PHP Flaws Prompt Widespread Site Outages and Patch Releases

Krebs on Security + 4 more

Security15h ago3 sources

Google, Apple, Mozilla block eight eMudhra certificates due to weak private keys

Dark Reading + 2 more