Security2 sources
PHP team releases mitigation steps for new remote code execution flaw
The PHP security team announced mitigation measures for a newly discovered remote code execution vulnerability that impacts systems using non‑default configurations and for which no patch exists. The PHP Project also published instructions to help administrators stop further exploits in limited settings.
Why it matters: Developers and operators must apply the mitigations immediately to protect PHP‑based services from active attacks.
Read the coverage
This story so far
How it developed, day by day.
Sunday 25 October
Critical PHP bugs threaten widespread web servicesSaturday 24 October
PHP team releases mitigation steps for new remote code execution flaw (this page)
Friday 23 October
Hackers exploited PHP2Shell bugs four days before patches releasedThursday 22 October
PHP releases emergency patches for two critical PHP2Shell RCE flaws (CVE‑2026‑109618, CVE‑2026‑109619)Wednesday 21 October
PHP warns of two critical flaws, emergency patches due tomorrow
More in Security
Security12h ago4 sources
Security19h ago3 sources
Security11h ago2 sources
Security16h ago2 sources