InfoSecBulletin Cybersecurity for mankind
The PHP team released urgent security updates to fix PHP2Shell, two serious flaws (CVE-2026-109618 and CVE-2026-109619) that let attackers run code from far away on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the team is pressing all PHP users to update right away.
PHP2Shell CVE-2026-109618 CVE-2026-109619
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit,” Wiz researchers explained.
Who is affected?
Every PHP setup that handles web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Systems using mod_php are the most at risk. An exploit has already proven that one unauthenticated request can start the attack before any application code is executed.
“The PHP situation will lead to a mass of incidents – it’s one of the biggest vulns in years,” noted security researcher Kevin Beaumont.
The vulnerabilities
CVE-2026-109618: RCE through OOM flaw: When there’s not enough memory, PHP might stop while some request data is only partly set up. This can lead to cleaning up requests that think the wrong data is okay.
CVE-2026-109619: RCE via stale global state: Request-owned internal state can last even after its memory is released. A later request managed by the same worker might use that old state before regular setup clears it.
The UK’s National Cyber Security Centre (NCSC) is telling groups to think about turning off any system that can’t be fixed quickly.
“So many embedded installations out there that will never be patched. Too many forgotten, unmaintained apps. There will be a long tail for this one,” commented computer forensics expert Hal Pomeranz.
How can you fix CVE-2026-109618 and CVE-2026-109619?
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Downloads are available here.
Linux distributions and long-term support (LTS) vendors received the fixes before the public release, so admins need to check with their vendor for new packages. The PHP project does not support PHP 8.1 and older versions anymore. Some vendors offer updated fixes for these versions, so users should reach out to their vendor or upgrade to a newer version.
Anyone using rpms.remirepo.net, a repository maintained by volunteers, should change to distribution packages or create PHP from the source to fix issues quickly. There are no updates available from the repository today.
The PHP security team has released small updates for PHP 7.4, 8.0, and 8.1 because the issues are serious. These updates are for people who build from source or don’t have a long-term support vendor.
“PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free,” said Dane Knecht, CTO at Cloudflare.
