PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
Summary: PHP released emergency updates in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for two critical runtime flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on CVSS v4.0, that let an unauthenticated attacker run code on a web server. The flaws sit in the PHP engine rather than application code, affect nearly every version back to PHP 5.4, and were published around 14:00 UTC on October 21 after details leaked a day before the planned October 22 disclosure.
What's compelling: Cloudflare reported early exploit attempts and attackers changing payloads to evade its firewall rules, while watchTowr moved from seeing none to observing active exploitation attempts of both CVEs at 14:19 UTC on October 21 - and the PHP Foundation called the months-long stall on a fix a structural failure of its decision process.