Critical RCE vulnerabilities: update now
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
PHP shipped emergency fixes for two critical remote-code flaws, CVE-2026-109618 and CVE-2026-109619.
Sites running unpatched PHP face takeover risk, and older versions get no official fix.
Background
PHP is a programming language that powers websites, web applications, content management systems, e-commerce platforms, APIs and hosting panels worldwide. Wiz Research, a security research team, found the two flaws and reported them to the PHP security team, the maintainers who issue PHP's security releases. PHP moved the coordinated release forward after information about the flaws reportedly leaked ahead of the planned date. PHP 8.1 and older no longer receive updates from the PHP project, though some distributions and long-term-support vendors provide backported fixes.
How it unfolded
- Aug 19, 2026Wiz Research discovers the first PHP vulnerability using its AI tooling.
- Aug 20, 2026 –21, 2026Unauthenticated remote code execution is confirmed against Drupal and then WordPress.
- Aug 24, 2026Wiz Research reports the vulnerabilities to the PHP security team.
- Sep 21, 2026PHP acknowledges the reports and begins developing a coordinated fix.
- Oct 20, 2026PHP issues an advance warning of an exceptional security release the next day; reports say details leaked early, and watchTowr confirms the flaws are real RCE issues tracked as CVE-2026-109618 and CVE-2026-109619. CERT-EU publishes advisory 2026-018 naming both IDs.
- Oct 21, 2026Patched releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 become available and the flaws are publicly disclosed. Unit 42 says it has seen proof of concept and that at least one European government took its website offline as a precaution; Cloudflare says WAF rules for known exploit vectors are deployed for all customers, including free.
Who’s saying what
- Official
- The PHP security team says all users should update immediately, that there are no complete mitigations and updating is the only safe choice.
- Caution
- UK NCSC urges organizations to patch PHP systems immediately and to consider taking offline any system that cannot be fixed right away.
- Expert
- Researcher Kevin Beaumont says the PHP situation will lead to a mass of incidents and calls it one of the biggest vulnerabilities in years.
- Expert
- Computer forensics expert Hal Pomeranz says many embedded installations will never be patched and there will be a long tail.
- Support
- Cloudflare CTO Dane Knecht says WAF rules for the known exploit vectors are deployed for all customers, including free.
Still unverified
An early leak claimed the flaws affect PHP releases back to PHP 5 and carry CVSS 10.0 scores; PHP's official rating is 9.2 and the claimed version range has not been confirmed by an official vendor advisory. watchTowr told BleepingComputer the flaws are believed to affect PHP versions 5, 6, 7 and 8. At the time of writing PHP had not disclosed the vulnerable components, exploitation requirements, affected releases or technical root causes, and the name "PHP2Shell" is informal and does not come from the PHP Project.