PHP releases emergency patches for two critical zero-day bugs
CIE News ·
Based on reporting by The Defiant; not yet independently confirmed.
PHP released emergency patches on October 21 after two critical remote code execution zero-day bugs were leaked online, prompting widespread warnings from security agencies.
PHP published emergency updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, to address two critical remote code execution flaws. According to lorikeetsecurity.com, the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed php2shell, hold a CVSS v4.0 rating of 9.2 out of 10 and were leaked online before coordinated disclosure.
The flaws allow unauthenticated remote code execution in default configurations, KuCoin reported. CVE-2026-109618 causes PHP to process incomplete data as finished following an out-of-memory state, while CVE-2026-109619 permits incoming requests to encounter residue from earlier visitors' data left in memory. Cloudflare Chief Technology Officer Dane Knecht reported emerging attacks roughly six hours before the fixes were made available, according to KuCoin.
Government agencies in the United States, Australia, Japan, and the United Kingdom recommended defensive measures, while several European public bodies took services offline as a precaution. KuCoin reported that W3Techs estimates PHP powers roughly 70% of websites with known server-side languages, with security firms warning that exploit scripts are actively circulating.
Key facts
- CVSS rating of 9.2
- CVE-2026-109618 and CVE-2026-109619
- Emergency PHP patches released
- Unauthenticated RCE flaws
Read the original at The Defiant