PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 to fix CVE-2026-109618 and CVE-2026-109619, two critical flaws each rated 9.2 under CVSS 4.0 that can let an attacker run code on a server without logging in, and PHP says updating is the only complete fix (php.net advisory, 21 Oct). Before the release, the PHP security team had said on 20 October 2026 that it would publish a security release on Wednesday 21 October at 14:00 UTC (10:00 pm Perth, 1:00 am 22 October in Sydney and Melbourne) to fix two critical vulnerabilities, each rated 9.2 under CVSS 4.0, and urged all PHP users to prepare to upgrade as soon as it lands. PHP says it may release earlier if details of either flaw become public or if exploitation appears in the wild, and that affected versions, fixed versions and technical details will only be published with the release. watchTowr told BleepingComputer the two bugs are remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619, believed to affect PHP 5, 6, 7 and 8, and that information about them leaked before the originally planned disclosure on Thursday 22 October at 11:00 am US Eastern. watchTowr says it has reproduced CVE-2026-109618 and is holding technical details until patches are out, and that it has not seen exploitation in the wild. BleepingComputer reports that a now-deleted post on Y Combinator's Hacker News forum, which it saw, had named the same CVE IDs, and that watchTowr and that post described the flaws as CVSS 10.0, while PHP itself rates them 9.2. BleepingComputer notes that PHP powers many websites and web applications, including content management systems, e-commerce platforms and custom web services. Primary: PHP.net news (20 Oct); wire: BleepingComputer (20 Oct). UPDATE (21 Oct): CERT-EU issued Security Advisory 2026-018 on the two flaws (published 20 Oct 20:33, v1.0 dated 21 Oct), saying they could affect all PHP versions from PHP 5 onwards and advising organisations to prepare for immediate patching and, where that is not possible, to consider isolating internet-facing PHP applications from public networks until a fix is applied. As of 08:20 Perth on 21 October PHP had not yet published the release. UPDATE (21 Oct, afternoon Perth): ASD's ACSC issued a 'critical' alert on the two flaws and said it was 'not aware of active exploitation related to these vulnerabilities', according to Information Age (22 Oct). Separately, The Hacker News reports that watchTowr's own FAQ says the PHP 5-onwards scope has not been confirmed by an official vendor advisory and lists no exploitation as of 21 October; Huntress said it had seen no exploitation and knew of no public exploit code as of 20 October; and security firm Mallory counted about 884,000 internet-facing hosts whose banners reported PHP 8.1 or older (end of life, no PHP fix), about 59% of the roughly 1.5 million hosts that reported a version. Researchers have nicknamed the pair 'php2shell'; that is not PHP's name. UPDATE (21 Oct, evening Perth): iTnews reports that, hours after the CVE IDs surfaced on social media, a researcher posted what they claim are full technical details of both flaws and two working exploit samples on the web; iTnews has seen the site but could not confirm the exploits work. PHP had not published the release as of 17:30 Perth on 21 October; its notice says it may release early if details become public. UPDATE (21 Oct, 20:30 Perth): The Hacker News reports that Tokyo firm GMO Flatt Security, which early on 21 October suggested setting session.upload_progress.enabled=0 as a stopgap, said later that day that the setting alone is not a complete fix and that bypasses are expected; PHP core developer Gina Peter Banyard said 'the only mitigation is patching / upgrading PHP', and PHP 8.6 release manager Joe Ferguson said 'ini settings won't save you'. Cloudflare published an emergency WAF release on 21 October adding four 'Anomalous Execution' rules to its Managed Ruleset (two blocking, two logging); THN reports Cloudflare says it is seeing early exploitation attempts and that its CTO calls the rules 'a STOPGAP only'. No compromise had been confirmed, the public exploit code had not been shown to work, and neither CVE was in CISA's KEV catalog as of 21 October. PHP had still not published the release at 20:30 Perth. UPDATE (21 Oct, 23:30 Perth): PHP released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October (after 10 am US Eastern, 10 pm Perth, according to The Record), saying they fix two critical vulnerabilities that can allow unauthenticated remote code execution and that all PHP users are strongly encouraged to update immediately. PHP says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and that it considers the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. PHP's GitHub advisories describe CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) as out-of-memory handling that can interrupt PHP while request data is only partially initialised, so that request cleanup treats the invalid data as valid, and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) as request-owned state that survives after its memory is freed and is used by a later request on the same worker (a use after free); both advisories rate the flaws 9.2 under CVSS 4.0 and list PHP versions below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected. PHP says PHP 8.1 and older no longer receive updates from the PHP project, that it has provided minimal source backports for PHP 7.4, 8.0 and 8.1, and that Linux distributions and LTS vendors received the patches in advance. It says only an update is a complete solution; the interim settings it lists reduce exposure to specific attack paths but do not make an installation safe. BleepingComputer reports the flaws were found by researchers at Calif, Wiz and OpenAI, and that the UK NCSC told UK organisations to update PHP systems immediately or take them offline until they are patched. watchTowr's head of threat intelligence, Jake Knott, told The Record that watchTowr is observing in-the-wild exploitation of the flaws with proof-of-concept tools built with the help of AI, and said: 'Whilst nobody has been successful to date, we don't expect that will last long.' Neither CVE was in CISA's KEV catalog as of 21 October. UPDATE (22 Oct, 2:30 am Perth): The PHP Foundation said in a 21 October blog post that full remote code execution through CVE-2026-109618 was demonstrated on Apache with mod_php with default settings, and that remote code execution was also confirmed on PHP-FPM through application-level code paths. The Foundation says a PHP core developer first found signs of the out-of-memory problem in 2024 while fixing an issue from a Quarkslab audit, that work on a fix stalled and restarted for months, and calls the delay 'a structural failure'; it says a Calif researcher reported an unconditional remote code execution with the same root cause on 11 August, OpenAI independently reported the same root cause that day, and Wiz (24 August) and OpenAI (18 September) reported further attack vectors. The Foundation says the two CVE IDs began circulating online at about 15:00 UTC on 20 October with a wrong release time and a wrong CVSS score of 10.0, so PHP brought its pre-announcement forward and moved the release from 22 to 21 October; it says Calif mistakenly published a video showing its proof of concept working, which contributed to faster development of proof-of-concept exploits, and that the PHP security team did not identify any functional exploits at the time of release. The PHP Foundation also says Chainguard broke the embargo at 07:41 UTC on 21 October, more than six hours before the coordinated release, by publishing built images containing the fix; The Record says Chainguard did not respond to its request for comment. CISA said in a 21 October alert that it strongly urges organisations to patch immediately, that it had not observed exploitation as of publication, and that organisations that cannot update immediately, or that still run PHP 8.1 or earlier, should take PHP-based systems offline until they are patched or updated. Palo Alto Networks said in an advisory published at 16:00 UTC on 21 October (midnight Perth) that PAN-OS and Panorama are affected and that Cloud NGFW, Prisma Access, Cortex XDR Agent, Cortex XSOAR, Cortex Xpanse, Bridgecrew and Idira are not; it says the issue will be fixed in upcoming PAN-OS releases, rates it CVSS-B 8.7 in PAN-OS when the management interface is reachable from the internet (7.1 when access is limited to a jump box), and says it is not aware of malicious exploitation against its products. ConnectWise said on its status page (21 Oct, 17:11 UTC) that it had temporarily taken the x360Recover Manager interface and Backup for Files Portal offline as a precaution in response to a critical PHP vulnerability, and that backups for all Axcient products are not impacted. According to the BBC, Finland temporarily shut down the government's public web services and the Dutch National Cyber Security Centre said it was taking its own website offline because of the flaws. UPDATE (22 Oct, 4:45 am Perth): Linux distributions have shipped fixed packages. Debian's security tracker lists php8.4 8.4.27-1~deb13u1 for Debian 13 trixie (DSA-6574-1) and php8.2 8.2.35-1~deb12u1 for Debian 12 bookworm (DLA-4848-1) as fixed. Ubuntu published USN-8948-1 and USN-8948-2 on 21 October, and its CVE page for CVE-2026-109618 lists fixes in php8.3 8.3.6-0ubuntu0.24.04.13 (24.04 LTS), php8.1 8.1.2-1ubuntu2.28 (22.04 LTS) and php8.5 8.5.4-0ubuntu1.5 (26.04 LTS), with fixes for some older releases available through Ubuntu Pro. The CVE records, published on 21 October, confirm CVSS 4.0 9.2 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) for both flaws, and CISA's enrichment of those records lists exploitation as 'none'. Neither CVE was in CISA's KEV catalog as of its 21 October 14:04 UTC update. PHP has published no new advisory since its 21 October release notice. UPDATE (22 Oct, 5:45 am Perth): Palo Alto Networks updated its advisory at 19:18 UTC on 21 October (3:18 am Perth 22 Oct) to list GlobalProtect App and Prisma Access Agent as not impacted; its FAQ says the issue strictly affects the PAN-OS management web interface (the HTTPS web UI and XML API service), affects a dataplane interface only if a management profile is attached to it, and does not affect GlobalProtect portals and gateways or the captive portal. Palo Alto still lists fixed PAN-OS and Panorama versions as 'ETA: TBD' as of 22 Oct. Red Hat's security bulletin RHSB-2026-013 rates the two flaws Important and lists Red Hat Enterprise Linux 10, 9 and 8 and Red Hat OpenShift Dev Spaces 3 as affected, saying RHEL 7 and earlier ship PHP versions that are not affected; Red Hat says some fixes are already available with more in progress, that standard RHEL deployments use PHP-FPM, where remote code execution is difficult in practice, and that environments running mod_php with default configuration are at higher risk. SUSE's page for CVE-2026-109618 lists fixed php8 8.3.36-150700.3.24.1 packages for SUSE Linux Enterprise Server 15 SP7 and its Web and Scripting module, with the overall issue still marked pending. ConnectWise said at 18:22 UTC on 21 October (2:22 am Perth 22 Oct) that x360Recover Manager and related services had been patched and restored, and that the Backup for Files Portal (Legacy Portal) remained temporarily unavailable as a security precaution. UPDATE (22 Oct, 8:30 am Perth): Palo Alto Networks' advisory timeline now also lists Cortex XSIAM and Prisma Cloud as not impacted and records that Threat IDs were released; it says customers with a Threat Prevention subscription get coverage by enabling Threat IDs 543004, 97622, 97623, 97624 and 97625 (Applications and Threats content version 9162 and later), and that for these Threat IDs to protect against the attack, management traffic must be routed through a dataplane port, the certificate for inbound management traffic replaced, that traffic decrypted and threat prevention enabled on it. Palo Alto still lists fixed PAN-OS and Panorama versions as 'ETA: TBD' as of 22 Oct. Fortinet's PSIRT advisory FG-IR-26-186 (21 Oct) says Fortinet is investigating the impact on FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard and FortiEndpoint, lists FortiOS, FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient for Linux, Windows and macOS, FortiSASE, FortiAuthenticator, FortiSwitch and FortiNAC as confirmed not impacted, and marks the issue 'Known Exploited: No'. The WA Government's Cyber Security Unit (WASOC) published advisory 20261022001 on 22 October recommending that administrators apply PHP's fixes, and said it had not received any reports of exploitation on Western Australian Government networks at the time of writing. UPDATE (22 Oct, 11:00 am Perth): Amazon Threat Intelligence says in an AWS Security Blog post (21 Oct, 22:36 UTC; 6:36 am Perth 22 Oct) that it identified a PHP2Shell exploitation attempt dating to 17 October in its MadPot honeypot telemetry, four days before public disclosure, from an IP address associated with a commercial anonymization network, and that it remains unclear how the actor acquired exploit information before disclosure. Amazon says it identified multiple proof-of-concept exploits on release day, the earliest around 02:00 UTC on 21 October, and further exploitation attempts against MadPot from other anonymized infrastructure between 02:00 and 08:00 UTC that suggested multiple actors; it says it is unclear if any of these attempts would have succeeded in real-world systems. Amazon says that once the embargo lifted at 14:00 UTC additional proof-of-concept exploits appeared within hours and were used against its sensors almost immediately, that PHP2Shell is now being broadly exploited in the wild, and that investigations should start from at least 17 October. AWS Security Bulletin 2026-143-AWS (first published 21 Oct) says AWS services are not impacted and that PHP 5.4 to 8.1 have no upstream fix; see the 23 Oct update for the status of AWS's own fixes. In Australia, according to Information Age (ACS), ASD said on Wednesday night (21 Oct) that it was 'aware of an outage that may be affecting government websites', including its own. ASD's 'ALERT UPDATE' post on X (22:51 UTC on 21 Oct; 6:51 am Perth 22 Oct), embedded in the Information Age report, says 'Patches are now available for two critical PHP vulnerabilities' and recommends that organisations using PHP identify affected systems, review official PHP guidance and apply appropriate mitigations as soon as possible. According to ABC News (22 Oct), GovCMS, which hosts many major Australian government websites, blocked direct access to its servers while keeping cached copies of public pages available; Moodle 'took its website offline as a precaution, before beginning to restore them after applying security fixes'; and Australian hosting provider VentraIP restricted some of its file uploads on customer hosting. UPDATE (23 Oct 2026, 7:45 am Perth): AWS updated Security Bulletin 2026-143-AWS at 14:00 PDT on 22 October (5:00 am Perth 23 Oct) to say its fixes have shipped: for Amazon WorkMail 'AWS has applied configuration-level controls and has completed the upgrade to PHP 8.3.36. No customer action is required'; for Elastic Beanstalk it 'has released updated PHP platform versions for all supported PHP versions (8.2 through 8.5) containing the upstream PHP fix'; updated Amazon Linux PHP packages are available for commercial regions, with non-commercial regions targeted for 22 October; and 'Updated Lightsail blueprints are now available in all regions'. AWS still says AWS services are not impacted and that PHP 5.4 to 8.1 have no upstream fix. Fortinet updated FG-IR-26-186 on 22 October: only FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS remain under investigation; FortiADC, FortiADC Manager, FortiClient EMS, FortiSIEM and FortiMonitor, among others, are now listed as confirmed not impacted; and it still marks the issue 'Known Exploited: No'. UPDATE (23 Oct 2026, 11:40 am Perth): Palo Alto Networks updated its advisory on 23 October to list WildFire Appliance WF-500 and WF-500-B as affected, with no fixed version yet ('ETA: TBD'); it says Cortex XCORE (SaaS) and WildFire Cloud were previously impacted and received remediation patches on 21 and 22 October respectively, and lists Cortex XDR Broker VM and Strata Cloud Manager as not impacted. At that update, fixed PAN-OS and Panorama versions were still 'ETA: TBD'. UPDATE (23 Oct 2026): Palo Alto Networks updated its advisory again at 03:45 UTC on 23 October (11:45 am Perth) to list fixed PAN-OS hotfix versions with estimated release dates from 26 to 30 October, for example 12.2.4-h1 (ETA 28 Oct), 12.1.10-h3 (ETA 30 Oct), 11.2.10-h16, 11.1.16-h4 and 10.2.18-h13 (ETA 26 Oct); Panorama and WildFire WF-500/WF-500-B still show no fixed version ('ETA: TBD'). Palo Alto still rates its own exposure CVSS-B 8.7 (High). (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (23 Oct 2026, 2:40 pm Perth): According to the BBC's live coverage on 22 October (UK time), a UK minister said 32 UK government services were unavailable and four partially unavailable because they were being fixed, and technology minister Baroness Lloyd of Effra said: "Whilst we have heard reports of exploitation activity and scanning internationally, we are not aware of any compromises in the UK public sector or in the UK as such." The UK NCSC's chief technology officer Ollie Whitehouse told BBC Radio 4 that the "scale of this is unprecedented" and that there are "no indications" at the moment of "any successful breaches", according to the BBC. The BBC also reports that the Government of Canada said some of its websites may be unavailable or disrupted while security updates are applied, and that "there is no indication at this time that any Government of Canada systems or information holdings have been compromised". UPDATE (23 Oct 2026, 5:40 pm Perth): Sophos corrected its own earlier report. In an update at 21:21 UTC on 22 October it said its customer telemetry shows scanning and a small number of failed exploitation attempts, not the successful exploitation it had reported at 16:18 UTC, and that there is no evidence of a successful compromise due to these vulnerabilities as of that update. Sophos says the attempted payload, a likely Mirai botnet variant known as Potassium, was not delivered because Sophos countermeasures blocked it, and that developing a successful exploit is not straightforward, but it still recommends urgent patching. (source: Sophos) UPDATE (25 Oct 2026): Palo Alto Networks revised its advisory again on 25 October, removing the estimated release dates for PAN-OS 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16, which the advisory now lists as fixed versions without an ETA; the other PAN-OS hotfixes still carry ETAs from 27 to 30 October (for example 11.2.13-h4 and 11.1.13-h16 on 27 October, 12.2.4-h1 on 28 October and 12.1.10-h3 on 30 October). The advisory's product table now lists WildFire Appliance WF-500 and WF-500-B as unaffected, following a 23 October revision that Palo Alto describes as a correction to their impact status, and it has no separate Panorama row; its note says the issue applies to PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). On 24 October Palo Alto added 20 more Threat Prevention signatures (Threat IDs 97643 to 97678, as listed in the advisory; content versions 9162, 9163, 9164 and later). Palo Alto still says it is not aware of any malicious exploitation of this issue against its products. (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (25 Oct 2026, 11:30 pm Perth): Palo Alto Networks reworded its 25 October timeline entry to say it removed the ETAs for PAN-OS 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 'as these versions are released'; the other PAN-OS hotfixes still carry ETAs from 27 to 30 October. (source: Palo Alto Networks advisory CVE-2026-109618) Correction (26 Oct 2026): Unit 42 retracted its 23 October update on 25 October (2:15 pm PT; 26 October, 5:15 am Perth), saying it is unable to confirm that the attack it described against a European government agency, carried out through a vulnerable PHP application, is associated with the PHP2Shell CVEs; our earlier update reporting that attack as PHP2Shell post-exploitation activity has been removed. (source: Palo Alto Networks Unit 42) UPDATE (26 Oct 2026): Schneider Electric's security notifications page now lists a security bulletin for the two flaws, SESB-2026-295-01, 'PHP Vulnerabilities (php2shell)', CVE-2026-109618 and CVE-2026-109619, last updated 22 October 2026. It lists the affected products and versions as EcoStruxure Security Expert (All versions prior to Version 1.48.4.0), ProLeiT LINEoptimize, formerly known as Plant iT LMS (All versions), and EcoStruxure Control Engineering (All versions). The listing itself gives no remediation steps; those are in the bulletin document. (source: Schneider Electric) UPDATE (26 Oct 2026): Palo Alto Networks revised its advisory on 26 October, removing the estimated release dates for PAN-OS 11.1.4-h38, 11.1.6-h40, 11.1.10-h36 and 11.1.13-h16 because those hotfixes are now released. On the 11.1 line, 11.1.7-h12 still carries an ETA of 30 October, and other hotfixes on the 12.2, 12.1, 11.2 and 10.2 lines still show ETAs from 27 to 30 October. (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (26 Oct 2026): Adel Karimi published honeypot evidence dated 24 October (UTC) of confirmed remote code execution: his report correlates 35 complete execution-stage requests with 35 /bin/sh processes started directly by Apache workers on three disposable honeypots running PHP 8.4.26 under Apache mod_php, from two source addresses, using a chain that closely matches a public HTTP-only proof-of-concept exploit; he says the activity is consistent with CVE-2026-109618 and that his records do not establish use of a distinct CVE-2026-109619 path. (source: Adel Karimi honeypot report) BleepingComputer, which describes Karimi as detection and response lead at Perplexity, reported on 26 October that Expel researcher Marcus Hutchins called it 'by far the highest quality confirmation of in-the-wild php2shell exploitation' he had seen. (source: BleepingComputer) UPDATE (27 Oct 2026; Palo Alto Networks): Palo Alto Networks revised its advisory on 27 October, removing the ETAs for PAN-OS 10.2.13-h27 and 10.2.16-h12 because those hotfixes are now released. As of 27 October the advisory lists nine PAN-OS hotfixes without an ETA (10.2.13-h27, 10.2.16-h12, 10.2.18-h13, 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4 and 11.2.10-h16); the others still carry ETAs from 27 to 30 October, including 11.2.13-h4 (ETA 27 October), 12.2.4-h1 (ETA 28 October) and 10.2.7-h39 and 11.1.7-h12 (ETA 30 October). Palo Alto still says it is not aware of any malicious exploitation of this issue against its products. (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (27 Oct 2026): CISA added CVE-2026-109618 ('PHP Memory Corruption Vulnerability') and CVE-2026-109619 ('PHP Stale Internal Request-State Vulnerability') to its Known Exploited Vulnerabilities (KEV) catalog on 26 October 2026, with a remediation due date of 29 October for US federal agencies and ransomware use listed as unknown, and updated its 21 October PHP alert to reflect the addition. This supersedes the earlier lines saying neither CVE was in the KEV catalog as of 21 October. (source: CISA) UPDATE (27 Oct 2026): Palo Alto Networks revised its advisory again on 27 October, removing the ETAs for PAN-OS 12.1.7-h11 and 12.2.4-h1 because those hotfixes are now released. The advisory now lists eleven PAN-OS hotfixes without an ETA (10.2.13-h27, 10.2.16-h12, 10.2.18-h13, 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4, 11.2.10-h16, 12.1.7-h11 and 12.2.4-h1); the others still carry ETAs from 27 to 30 October, including 11.2.13-h4 (ETA 27 October) and 10.2.7-h39, 11.1.7-h12 and 12.1.10-h3 (ETA 30 October). Palo Alto still says it is not aware of any malicious exploitation of this issue against its products. (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (28 Oct 2026, Perth; Palo Alto Networks): Palo Alto Networks revised its advisory again on 27 October, updating the severity to Critical (CVSS-B 9.2) with suggested urgency Highest, and its Exploitation Status now reads: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." This supersedes the earlier lines saying Palo Alto was not aware of malicious exploitation against its products. Palo Alto says the risk is highest when the management interface is reachable from external IP addresses on the internet and that the issue strictly affects the management web interface (the HTTPS web UI and XML API); GlobalProtect portal, gateway and Clientless VPN and the captive portal are not impacted. The hotfix list is unchanged from its previous revision; as of 28 Oct (Perth) the hotfixes still carrying ETAs include 11.2.13-h4 (27 October), 11.2.16-h1 (28 October), 10.2.10-h42, 11.2.7-h23 and 12.1.4-h13 (29 October), and 10.2.7-h39, 11.1.7-h12, 11.2.4-h23 and 12.1.10-h3 (30 October). (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (28 Oct 2026, Perth; Palo Alto Networks): In its latest revision of the advisory (dated 27 October), Palo Alto Networks changed its Exploitation Status from very limited exploitation to: "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet." The advisory timeline has no separate entry for this wording change. Hotfix ETAs read the same as in the previous revision: 11.2.13-h4 (ETA 27 October), 11.2.16-h1 (28 October), 10.2.10-h42, 11.2.7-h23 and 12.1.4-h13 (29 October), and 10.2.7-h39, 11.1.7-h12, 11.2.4-h23 and 12.1.10-h3 (30 October). Restrict the management interface to trusted internal IP addresses until your hotfix is out. (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (28 Oct 2026, Perth; Palo Alto Networks): In a revision dated 28 October, Palo Alto Networks removed the ETAs for PAN-OS 11.2.7-h23, 11.2.13-h4 and 11.2.16-h1 'as these versions are released'. Hotfixes still carrying ETAs are 10.2.10-h42 and 12.1.4-h13 (29 October), and 10.2.7-h39, 11.1.7-h12, 11.2.4-h23 and 12.1.10-h3 (30 October). (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (29 Oct 2026, Perth; Dream; The Hacker News): Israeli security company Dream published research dated 26 October saying that on 25 October its researchers uncovered artifacts of what appeared to be a Chinese AI-assisted campaign that combined a custom, non-public PHP2Shell exploit (CVE-2026-109618/CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to root 25 servers across the United States, Japan, Taiwan and South Korea, including systems in a US government-affiliated environment. Dream says the affected devices run specific versions of a large vendor's firewall software, which it does not name; the vendor has been notified. According to Dream, the exploit targets PHP's session.upload_progress mechanism on the firewall's management web server (PHP 8.0.30), and the attacker used FOFA to find about 19,000 internet-facing firewalls, fingerprinted about 5,000, filtered to 240 targets and rooted 24 firewalls, planting a web shell; two belonged to a US government-affiliated organisation (rooted on 23 Oct at 18:14 UTC, which then crashed, and on 24 Oct at 10:09 UTC), and at 11:35 UTC a third, internal firewall management server was rooted through a reverse SSH tunnel and used to attack Active Directory. Dream says Claude Code had been installed and the aiscan platform was configured with DeepSeek and Kimi models in the attack infrastructure, but it has no direct evidence the AI tools wrote the exploit, and that it cannot determine the full extent of the compromise. (source: Dream; The Hacker News)
- Product
- PHP (server-side scripting language and runtime)
- Versions
- Affected: PHP below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (PHP advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp). Fixed: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (21 Oct 2026). PHP 8.1 and older get no PHP project updates; PHP published minimal source backports for 7.4, 8.0 and 8.1. As of 21 Oct.
- CVSS
- 9.2 (CVSS 4.0, PHP) for each flaw
- Exploited in Australia?
- unknown
- Patch to
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now, or install your Linux distribution's or LTS vendor's patched package (PHP says they received the patches in advance, so check your vendor; Debian DSA-6574-1 and DLA-4848-1 and Ubuntu USN-8948-1 and USN-8948-2 are out), then restart Apache, PHP-FPM and any long-running PHP workers so the fixed runtime is loaded. Updating an application such as WordPress or Laravel does not update the PHP runtime beneath it (The Hacker News). On PHP 8.1 or older, upgrade to a supported branch or get backported fixes from your vendor; PHP has published minimal source backports for 7.4, 8.0 and 8.1. If you cannot update at once, PHP's interim measures reduce but do not remove exposure: for CVE-2026-109618 set memory_limit=-1 in a way applications cannot override (for example php_admin_value), keep post_max_size low (8M without uploads, 32M with) and enforce request-size limits at the web server or proxy, and do not use RLIMIT_AS or RLIMIT_DATA; for CVE-2026-109619 set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration and restart every worker, and on PHP 8.5 also set fatal_error_backtraces=0. Prioritise Apache mod_php servers, which PHP rates highest risk. Treat WAF rules such as Cloudflare's as a stopgap only. ASD (alert update on X, 21 Oct, as embedded by Information Age): identify affected systems, review official PHP guidance and apply appropriate mitigations as soon as possible. Palo Alto Networks PAN-OS and Panorama (all versions affected, per Palo Alto, 21 Oct; Palo Alto rated the issue Critical, urgency Highest, on 27 Oct; its advisory now says active exploitation has been observed targeting the management interface exposed to the internet): Palo Alto's advisory (as of its second 27 Oct revision) lists 10.2.13-h27, 10.2.16-h12, 10.2.18-h13, 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4, 11.2.10-h16, 12.1.7-h11 and 12.2.4-h1 as released (no ETA) and the other PAN-OS hotfixes with ETAs from 27 to 30 Oct (for example 11.2.13-h4, ETA 27 Oct; check the advisory for your train), and says the issue also applies to Panorama; until you can install the hotfix, restrict the management interface to trusted internal IP addresses or a jump box, and Advanced Threat Prevention customers can use the Threat IDs listed in the advisory (543004, 97622 to 97625 and, since 24 Oct, 20 more from 97643 to 97678); watch the Palo Alto advisory for fixed versions. CISA (21 Oct): inventory every system running PHP, including products that bundle it, patch internet-facing systems first, take PHP-based systems offline if you cannot update immediately or run PHP 8.1 or earlier, and watch for PHP worker processes launching shells or downloading tools. Red Hat (RHSB-2026-013): RHEL 8, 9 and 10 and OpenShift Dev Spaces 3 are affected; install Red Hat's php updates as they ship, keep the php package current in layered products that pull from RHEL channels, and rebuild containers when the RHEL/UBI base images are updated. SUSE: SLES 15 SP7 php8 8.3.36-150700.3.24.1 or later. Palo Alto (22 Oct): Threat Prevention customers enable the Threat IDs listed in the advisory (543004, 97622–97625 and, since 24 Oct, 20 more from 97643 to 97678; content 9162, 9163, 9164 and later); Palo Alto says they protect only when management traffic is routed through a dataplane port, the inbound management certificate is replaced, and that traffic is decrypted and inspected with threat prevention. Fortinet: watch FG-IR-26-186 for the five products still under investigation (FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR, FortiSOAR PaaS; updated 22 Oct). AWS (Security Bulletin 2026-143-AWS, updated 22 Oct 14:00 PDT): Amazon WorkMail needs no customer action; on Elastic Beanstalk, Managed Platform Updates apply the fixed PHP platform versions (8.2 to 8.5) in the next maintenance window, otherwise update the environment's platform version; apply the updated Amazon Linux PHP packages (available in all regions, per AWS's 23 Oct 13:30 PDT update); Lightsail instances cannot be updated in place, so create new instances from the updated blueprints (now available in all regions) and migrate. Amazon also advises looking for POST requests carrying PHP_SESSION_UPLOAD_PROGRESS and investigating from at least 17 October. Schneider Electric (as of 26 Oct): check bulletin SESB-2026-295-01 for EcoStruxure Security Expert (all versions prior to Version 1.48.4.0), ProLeiT LINEoptimize (Plant iT LMS) and EcoStruxure Control Engineering.
Primary: PHP.net — Security advisory: Critical remote code execution vulnerabilities, update now (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; 21 Oct 2026) · Vendor: PHP.net — Upcoming Critical PHP Security Release (20 Oct 2026) · CVE: CVE-2026-109618, CVE-2026-109619, CVE-2026-46300 · Information Age (ACS) — Govt sites go down after AI finds 'critical' PHP vulnerabilities (22 Oct 2026; reports ASD/ACSC statements) · Dream — Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers (26 Oct 2026) · The Hacker News — PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network (28 Oct 2026) · BleepingComputer — PHP warns admins of two critical flaws, emergency patches coming tomorrow (20 Oct 2026) · Adel Karimi (honeypot-data) — PHP2Shell exploitation observed: packet-to-process RCE evidence (24 Oct 2026) · BleepingComputer — PHP2Shell security flaws now sucessfully exploited in the wild (26 Oct 2026) · Schneider Electric — Security notifications: SESB-2026-295-01 PHP Vulnerabilities (php2shell) (last updated 22 Oct 2026) · Palo Alto Networks Unit 42 — Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23) · AWS Security Blog — Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (21 Oct 2026) · AWS Security Bulletin 2026-143-AWS — PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) (updated 22 Oct 2026) · Fortinet PSIRT FG-IR-26-186 — PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619) (updated 22 Oct 2026) · Palo Alto Networks — CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products · WASOC — PHP Critical Vulnerabilities named PHP2Shell - 20261022001 (22 Oct 2026) · ABC News — Australians face spike in data breaches after AI helps uncover 'critical' website flaw (22 Oct 2026) · ASD (@ASDGovAu) on X — ALERT UPDATE: Patches are now available for two critical PHP vulnerabilities (21 Oct 2026, 22:51 UTC) · BBC News — Scale of cyber-security flaw 'unprecedented' but no sign of breaches, says expert (live page, 22 Oct 2026) · Sophos — Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) (updated 22 Oct 2026) · The PHP Foundation — Today's PHP security release and how we're strengthening PHP security (21 Oct 2026; Chainguard embargo break, Calif video) · Ubuntu — USN-8948-1: PHP vulnerabilities (21 Oct 2026) · Ubuntu — USN-8948-2: PHP vulnerabilities (21 Oct 2026) · Red Hat — RHSB-2026-013 Request handling memory corruption - php ("php2shell") · CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-109618, CVE-2026-109619) (26 Oct 2026) · CISA Known Exploited Vulnerabilities Catalog — CVE-2026-109618 (added 26 Oct 2026) · CISA — Critical Vulnerabilities in PHP Require Immediate Patching (21 Oct 2026; last revised 26 Oct 2026)
vulnerabilities australia
