PHP issues emergency patches for two critical remote code execution flaws
In short
The PHP development team released emergency security updates on 21 October for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS 4.0 scale. Tencent Cloud said they allow unauthenticated remote code execution, and some government websites in Europe were taken offline ahead of the patch.
Read the full story 2 min read
The PHP development team released emergency security updates on 21 October to fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The team had announced the release for 14:00 UTC, or 22:00 Beijing time, and cnBeta reported at 22:36 that the update was out. Huxiu reported that the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. [ 3 , 8 , 12 ]
IT Home said the PHP team announced the plan on 20 October, and that both flaws are rated 9.2 under CVSS v4.0. The security firm watchTowr confirmed they are zero-day remote code execution flaws. The release had originally been planned for 22 October, and the team said it could come earlier still if details became public or exploitation appeared. On 20 October a post on Hacker News said two flaws affecting PHP 5 and later were about to be disclosed, and screenshots then spread on X and Mastodon. PHP's own statement, reported by CLS, said the CVE numbers began circulating on online forums and social media around 15:00 UTC that day. [ 3 , 4 , 9 , 12 ]
Tencent Cloud's security centre, in an advisory reported by CLS and Jiemian, called the flaws "php2shell". It said an unauthenticated remote attacker could send a crafted multipart POST request to trigger memory corruption and remote code execution, potentially taking full control of a server. It advised customers to check their systems and update. [ 10 , 11 ]
Agencies abroad urged preparation. According to IT Home, citing Reuters, CERT-EU said the 9.2 score indicates a risk of remote code execution without login, and that organisations unable to patch in time should consider taking affected websites offline temporarily. The Australian Cyber Security Centre gave similar advice and said it had seen no exploitation. GoDaddy warned of data theft and website tampering. Finland's Valtori then took government public-service websites offline, including those of the National Land Survey, the Helsinki Book Fair and the Finnish Film Foundation, with no restoration date given. Huxiu added that the Netherlands, France, Germany and Japan took similar steps. [ 5 , 7 , 12 ]
Landian and cnBeta said observation data showed about 59.4% of 1.5 million exposed PHP hosts run older versions that cannot be updated, and that PHP 5.6 and 7.x will not be patched. Huxiu said PHP 8.1 and earlier get only a source patch that must be compiled by the user. It said the flaw traces back to PHP 5.4.0 from 2012 and that forensic specialist Hal Pomeranz expects many unmaintained sites may never be updated. [ 1 , 2 , 12 ]
Huxiu reported that the security firms Calif and Wiz independently found the flaws using AI tools, and that Cloudflare detected the first attacks at 07:43 GMT on 21 October, hours before the patch. IT Home had reported no public evidence of large-scale exploitation. Huxiu said Cloudflare set blocking rules for all customers, which its chief technology officer Dane Knecht called a temporary measure, and that Cloudflare shares rose by more than 8% at one point. [ 3 , 5 , 12 ]
Why it matters
Chinese outlets stressed that PHP underpins many websites and that a large share of exposed PHP hosts run versions that will not get official updates. Cloud providers and security agencies urged administrators to check their PHP versions and upgrade at once.
Key facts
- The PHP security team announced a security update for 14:00 UTC on 21 October (22:00 Beijing time) to fix CVE-2026-109618 and CVE-2026-109619. [ 3 , 12 ]
- Both vulnerabilities are rated 9.2 under CVSS v4.0, which IT Home described as critical. [ 3 , 5 ]
- Tencent Cloud said an unauthenticated remote attacker could send a crafted multipart POST request to trigger memory corruption and remote code execution, and gave the flaws the code name "php2shell". [ 10 , 11 ]
- CERT-EU advised organisations that cannot patch in time to consider taking affected websites offline temporarily. [ 5 , 6 , 7 ]
- Finland's government ICT centre Valtori took public-service websites offline as a precaution and gave no restoration timetable. [ 7 ]
- Huxiu reported that fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on 21 October. [ 12 ]
- Landian and cnBeta cited observation data that about 59.4% of 1.5 million exposed PHP hosts run older versions that cannot get updates. [ 1 , 2 ]
Confirmed by several sources
- The two flaws are CVE-2026-109618 and CVE-2026-109619, both rated 9.2. [ 1 , 2 , 3 , 5 , 8 ]
- The PHP team scheduled the fix for 22:00 Beijing time (14:00 UTC) on 21 October, and cnBeta reported at 22:36 that the update had been released. [ 1 , 2 , 3 , 8 , 12 ]
- European cybersecurity officials advised organisations that could not patch in time to take affected websites offline temporarily. [ 5 , 6 , 7 ]
- Finnish government websites were taken offline over the PHP vulnerabilities. [ 7 , 12 ]
- PHP 5.6, 7.x and other older versions will not receive official updates. [ 1 , 2 , 12 ]
Still unclear
- Which PHP versions are affected. IT Home said CERT-EU and ACSC pointed to PHP 5 and later, while the PHP team had not yet published affected versions; Huxiu said the flaw dates back to PHP 5.4.0.
- Whether the flaws were exploited before the patch. Huxiu reported Cloudflare detected the first attacks at 07:43 GMT on 21 October, hours before the patch. IT Home reported no public evidence of large-scale exploitation, and said the Australian Cyber Security Centre had seen none.
- Whether any mitigation exists for unsupported versions. Landian said it was not known; IT Home said no official temporary mitigation had been found. Huxiu said PHP 8.1 and earlier get only a source patch that users must compile themselves, and Cloudflare called its own blocking rules a temporary measure.
- Which other countries took sites offline. Huxiu alone listed the Netherlands, France, Germany and Japan; other outlets mention only Finland and the EU advice.
- Tencent Cloud published a risk advisory on the flaws, which it named "php2shell". Reported by a single source so far
What local media are saying
Timeline, local time
- Landian reports the PHP security team will release an emergency update at 22:00. [ 1 ]
- Per Huxiu, Cloudflare detects the first attacks at 07:43 GMT, which is 15:43 Beijing time. [ 3 , 12 ]
- IT Home, citing Reuters, reports CERT-EU advice to take unpatched sites offline. [ 5 ]
- IT Home reports Valtori is taking Finnish government websites offline. [ 7 ]
- Scheduled release time of the PHP security update (14:00 UTC). [ 3 , 12 ]
- cnBeta reports the PHP team has released the emergency update. [ 8 ]
- CLS reports Tencent Cloud's advisory on the "php2shell" flaws. [ 10 ]