PHP2Shell
PHP2Shell is the name given to two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. Details leaked before the fixes. PHP shipped fixed releases for every supported line on 21 October 2026: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. This page collects all our reporting, newest first.
Latest
CISA adds two PHP flaws to its Known Exploited Vulnerabilities catalog The US cyber agency listed both PHP bugs in a catalog of exploited flaws and updated its PHP alert.Earlier reporting
One SANS handler: some php2shell PoCs rely on lab settings The demo uses an 8 MB memory limit and one worker; real servers usually differ. A bypass of the current fix may exist. Japan to simulate AI cyberattacks as PHP flaws force sites offline Japan will build a team to probe systems for weak spots after critical PHP flaws disrupted services worldwide. A PHP flaw hit even current versions, so patch speed mattered more than age The show's PHP story was about speed, not neglect; a separate post warned that forgotten projects get found. A decade-old PHP flaw became a working exploit in hours with AI, Wiz says Wiz argues PHP2Shell shows 'too hard to exploit' was a defence, and that AI is changing how long it holds. AWS honeypot logged a PHP2Shell attempt four days before the PHP fix In one AWS honeypot, exploitation attempts began October 17, before the October 21 public disclosure. PHP2Shell: the fix is routine on current PHP; finding every server is harder Two flaws in PHP itself, found with AI help, leave older and forgotten servers at the centre of the risk AWS says an attacker probed a PHP2Shell decoy four days before the patches Amazon Web Services says a decoy server was hit on October 17, before the PHP fixes were public. Two flaws in PHP itself affect sites on vulnerable versions, Patchstack says The weakness sits below WordPress, Drupal and Magento. Your host's patch schedule now matters. Two critical PHP flaws leaked before fixes; patches due October 21 Aikido Security says both bugs allow remote code execution and that all PHP versions should be treated as affected.Other trackers: Windows updates, Node.js security releases, eMudhra certificate compromise, DeepSeek