PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

{"title":"PHP Rushes Out Fixes for Two Critical PHP2Shell RCE Bugs Amid Early Exploit Attempts","seo_title":"PHP Patches Critical PHP2Shell RCE Flaws","seo_description":"Patch released: PHP fixes CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) in 8.5.12, 8.4.27, 8.3.36, 8.2.35. Unauthenticated RCE; update and restart workers now.","body_md":"PHP has rushed out emergency builds 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to close two critical vulnerabilities, dubbed PHP2Shell, that allow an unauthenticated attacker to execute code on a web server. Tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0, the bugs live in the PHP engine itself rather than in any application, so even secure sites remain exposed, especially those running Apache's mod_php, where a single crafted request can trigger code execution before the application even loads. The flaws, found by researchers at Wiz, Calif, and OpenAI and dating back over a decade in PHP's codebase, also let attackers read memory from worker processes, potentially exposing credentials and tokens from unrelated requests, even without full code execution. PHP pushed the release forward after details leaked ahead of a planned October 22 disclosure, and Cloudflare has already observed early exploitation attempts in the wild, prompting some organizations, including BambooHR and several Dutch government sites, to take services offline as a precaution. Administrators are urged to update their PHP runtime and restart all affected services immediately, since configuration workarounds only partially reduce exposure and do not fully resolve either flaw.”}