PHP ships emergency patches for two critical PHP2Shell remote code execution flaws

Summary

PHP's security team released emergency patches for two critical remote code execution flaws, tracked collectively as PHP2Shell and assigned CVE-2026-109618 and CVE-2026-109619, after warning administrators to prepare for the updates. Before the release, BleepingComputer reported that information about the flaws had reportedly leaked ahead of their scheduled disclosure. Ars Technica reported that PHP planned to release two emergency patches imminently and noted an unconfirmed report that the PHP2Shell exploit remotely executes code on PHP sites. The Hacker News reported that the flaws were rated 9.2 on the CVSS v4.0 scale without being described, that the out-of-cycle release was scheduled for 14:00 UTC on October 21, and that no exploitation had been reported so far. The Hacker News later reported that the fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and that the flaws sit in the PHP runtime rather than in any application, so a site is exposed even when its own code is sound.

Timeline

1. BleepingComputer

   20 Oct 2026, 20:56 UTCSource ↗

   BleepingComputer reports that the PHP security team warned administrators to prepare for emergency security updates the next day to fix two critical vulnerabilities, after information about the flaws reportedly leaked ahead of their scheduled disclosure.

2. Ars Technica

   21 Oct 2026, 02:12 UTCSource ↗

   Ars Technica reports that PHP plans to release two emergency patches imminently, and that an unconfirmed report claims the PHP2Shell exploit remotely executes code on PHP sites.

3. The Hacker News

   21 Oct 2026, 09:05 UTCSource ↗

   The Hacker News reports that PHP will ship an out-of-cycle security release at 14:00 UTC on October 21 for two flaws rated 9.2 on the CVSS v4.0 scale, that only PHP branches 8.2 through 8.5 can receive the fix, and that no exploitation has been reported so far.

4. The Hacker News

   21 Oct 2026, 14:00 UTCSource ↗

   The Hacker News reports that PHP has released emergency updates fixing the two PHP2Shell flaws in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and that the PHP team says only updating fully protects a server.

5. BleepingComputer

   21 Oct 2026, 14:07 UTCSource ↗

   BleepingComputer reports that the PHP security team released emergency patches for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, tracked collectively as PHP2Shell.