InfoSecBulletin Cybersecurity for mankind
The PHP team released urgent security updates to fix PHP2Shell, two serious flaws (CVE-2026-109618 and CVE-2026-109619) that let attackers run code from far away on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the team is pressing all PHP users to update right away.
PHP2Shell CVE-2026-109618 CVE-2026-109619
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit,” Wiz researchers explained.
Who is affected?
Every PHP setup that handles web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Systems using mod_php are the most at risk. An exploit has already proven that one unauthenticated request can start the attack before any application code is executed.
“The PHP situation will lead to a mass of incidents – it’s one of the biggest vulns in years,” noted security researcher Kevin Beaumont.
The vulnerabilities
CVE-2026-109618: RCE through OOM flaw: When there’s not enough memory, PHP might stop while some request data is only partly set up. This can lead to cleaning up requests that think the wrong data is okay.
CVE-2026-109619: RCE via stale global state: Request-owned internal state can last even after its memory is released. A later request managed by the same worker might use that old state before regular setup clears it.
The UK’s National Cyber Security Centre (NCSC) is telling groups to think about turning off any system that can’t be fixed quickly.
“So many embedded installations out there that will never be patched. Too many forgotten, unmaintained apps. There will be a long tail for this one,” commented computer forensics expert Hal Pomeranz.
How can you fix CVE-2026-109618 and CVE-2026-109619?
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Downloads are available here.
Linux distributions and long-term support (LTS) vendors received the fixes before the public release, so admins need to check with their vendor for new packages. The PHP project does not support PHP 8.1 and older versions anymore. Some vendors offer updated fixes for these versions, so users should reach out to their vendor or upgrade to a newer version.
Anyone using rpms.remirepo.net, a repository maintained by volunteers, should change to distribution packages or create PHP from the source to fix issues quickly. There are no updates available from the repository today.
The PHP security team has released small updates for PHP 7.4, 8.0, and 8.1 because the issues are serious. These updates are for people who build from source or don’t have a long-term support vendor.
“PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free,” said Dane Knecht, CTO at Cloudflare.
