PHP Releases Emergency PHP2Shell Security Fixes

PHP released fixes on October 21 for critical PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, rated 9.2 under CVSS v4.0, which can let unauthenticated attackers execute code and potentially take control of affected servers, steal data or disrupt services. Researchers used AI tools to identify or demonstrate ways to exploit the underlying memory-handling flaws, which had remained undetected for years; exploit details leaked before the planned patch release. Cloudflare reported millions of exploitation attempts after disclosure, and Amazon observed probing as early as October 17, though the number of successful attacks remains unclear. Fixes are available for PHP 8.2 through 8.5, with some older releases receiving vendor backports; because PHP 8.1 and earlier lack upstream support, operators should check for backports or isolate vulnerable systems, identify all PHP runtimes, apply updates and review systems and logs for signs of compromise. The NSA and PHP maintainers urged immediate updates or taking vulnerable systems offline; Finland and the Netherlands took some public-facing government websites offline as a precaution, while Australian officials reported no confirmed exploitation. Cloudflare's temporary firewall protections are not a substitute for updates, and operators should also check embedded PHP in appliances, infrastructure and public-facing websites.