Update PHP now: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released on 21 October to fix two critical flaws that can allow unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619; CVSS 4.0 9.2); PHP says updating is the only complete fix and rates the risk highest for Apache mod_php; Amazon says PHP2Shell is now being broadly exploited in the wild; Palo Alto Networks says PAN-OS and Panorama are affected, with fixed PAN-OS releases still to come
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 to fix CVE-2026-109618 and CVE-2026-109619, two critical flaws each rated 9.2 under CVSS 4.0 that can let an attacker run code on a server without logging in, and PHP says updating is the only complete fix (php.net advisory, 21 Oct). Before the release, the PHP security team had said on 20 October 2026 that it would publish a security release on Wednesday 21 October at 14:00 UTC (10:00 pm Perth, 1:00 am 22 October in Sydney and Melbourne) to fix two critical vulnerabilities, each rated 9.2 under CVSS 4.0, and urged all PHP users to prepare to upgrade as soon as it lands. PHP says it may release earlier if details of either flaw become public or if exploitation appears in the wild, and that affected versions, fixed versions and technical details will only be published with the release. watchTowr told BleepingComputer the two bugs are remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619, believed to affect PHP 5, 6, 7 and 8, and that information about them leaked before the originally planned disclosure on Thursday 22 October at 11:00 am US Eastern. watchTowr says it has reproduced CVE-2026-109618 and is holding technical details until patches are out, and that it has not seen exploitation in the wild. A now-deleted Hacker News post had named the same CVE IDs. watchTowr and that post described the flaws as CVSS 10.0, while PHP itself rates them 9.2. PHP runs a large share of web servers, content management systems and e-commerce platforms, including WordPress, Drupal and Magento sites hosted in Australia. Primary: PHP.net news (20 Oct); wire: BleepingComputer (20 Oct). UPDATE (21 Oct): CERT-EU issued Security Advisory 2026-018 on the two flaws (published 20 Oct 20:33, v1.0 dated 21 Oct), saying they could affect all PHP versions from PHP 5 onwards and advising organisations to prepare for immediate patching and, where that is not possible, to consider isolating internet-facing PHP applications from public networks until a fix is applied. As of 08:20 Perth on 21 October PHP had not yet published the release. UPDATE (21 Oct, afternoon Perth): ASD's ACSC issued a 'critical' alert on the two flaws and said it was 'not aware of active exploitation related to these vulnerabilities', according to Information Age (22 Oct). Separately, The Hacker News reports that watchTowr's own FAQ says the PHP 5-onwards scope has not been confirmed by an official vendor advisory and lists no exploitation as of 21 October; Huntress said it had seen no exploitation and knew of no public exploit code as of 20 October; and security firm Mallory counted about 884,000 internet-facing hosts whose banners reported PHP 8.1 or older (end of life, no PHP fix), about 59% of the roughly 1.5 million hosts that reported a version. Researchers have nicknamed the pair 'php2shell'; that is not PHP's name. UPDATE (21 Oct, evening Perth): iTnews reports that, hours after the CVE IDs surfaced on social media, a researcher posted what they claim are full technical details of both flaws and two working exploit samples on the web; iTnews has seen the site but could not confirm the exploits work. PHP had not published the release as of 17:30 Perth on 21 October; its notice says it may release early if details become public. UPDATE (21 Oct, 20:30 Perth): The Hacker News reports that Tokyo firm GMO Flatt Security, which early on 21 October suggested setting session.upload_progress.enabled=0 as a stopgap, said later that day that the setting alone is not a complete fix and that bypasses are expected; PHP core developer Gina Peter Banyard said 'the only mitigation is patching / upgrading PHP', and PHP 8.6 release manager Joe Ferguson said 'ini settings won't save you'. Cloudflare published an emergency WAF release on 21 October adding four 'Anomalous Execution' rules to its Managed Ruleset (two blocking, two logging); THN reports Cloudflare says it is seeing early exploitation attempts and that its CTO calls the rules 'a STOPGAP only'. No compromise had been confirmed, the public exploit code had not been shown to work, and neither CVE was in CISA's KEV catalog as of 21 October. PHP had still not published the release at 20:30 Perth. UPDATE (21 Oct, 23:30 Perth): PHP released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October (after 10 am US Eastern, 10 pm Perth, according to The Record), saying they fix two critical vulnerabilities that can allow unauthenticated remote code execution and that all PHP users are strongly encouraged to update immediately. PHP says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and that it considers the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. PHP's GitHub advisories describe CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) as out-of-memory handling that can interrupt PHP while request data is only partially initialised, so that request cleanup treats the invalid data as valid, and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) as request-owned state that survives after its memory is freed and is used by a later request on the same worker (a use after free); both advisories rate the flaws 9.2 under CVSS 4.0 and list PHP versions below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected. PHP says PHP 8.1 and older no longer receive updates from the PHP project, that it has provided minimal source backports for PHP 7.4, 8.0 and 8.1, and that Linux distributions and LTS vendors received the patches in advance. It says only an update is a complete solution; the interim settings it lists reduce exposure to specific attack paths but do not make an installation safe. BleepingComputer reports the flaws were found by researchers at Calif, Wiz and OpenAI, and that the UK NCSC told UK organisations to update PHP systems immediately or take them offline until they are patched. watchTowr's head of threat intelligence, Jake Knott, told The Record that watchTowr is observing in-the-wild exploitation of the flaws with proof-of-concept tools built with the help of AI, and said: 'Whilst nobody has been successful to date, we don't expect that will last long.' Neither CVE was in CISA's KEV catalog as of 21 October. UPDATE (22 Oct, 2:30 am Perth): The PHP Foundation said in a 21 October blog post that full remote code execution through CVE-2026-109618 was demonstrated on Apache with mod_php with default settings, and that remote code execution was also confirmed on PHP-FPM through application-level code paths. The Foundation says a PHP core developer first found signs of the out-of-memory problem in 2024 while fixing an issue from a Quarkslab audit, that work on a fix stalled and restarted for months, and calls the delay 'a structural failure'; it says a Calif researcher reported an unconditional remote code execution with the same root cause on 11 August, OpenAI independently reported the same root cause that day, and Wiz (24 August) and OpenAI (18 September) reported further attack vectors. The Foundation says the two CVE IDs began circulating online at about 15:00 UTC on 20 October with a wrong release time and a wrong CVSS score of 10.0, so PHP brought its pre-announcement forward and moved the release from 22 to 21 October; it says Calif mistakenly published a video showing its proof of concept working, which contributed to faster development of proof-of-concept exploits, and that the PHP security team did not identify any functional exploits at the time of release. The PHP Foundation also says Chainguard broke the embargo at 07:41 UTC on 21 October, more than six hours before the coordinated release, by publishing built images containing the fix; The Record says Chainguard did not respond to its request for comment. CISA said in a 21 October alert that it strongly urges organisations to patch immediately, that it had not observed exploitation as of publication, and that organisations that cannot update immediately, or that still run PHP 8.1 or earlier, should take PHP-based systems offline until they are patched or updated. Palo Alto Networks said in an advisory published at 16:00 UTC on 21 October (midnight Perth) that PAN-OS and Panorama are affected and that Cloud NGFW, Prisma Access, Cortex XDR Agent, Cortex XSOAR, Cortex Xpanse, Bridgecrew and Idira are not; it says the issue will be fixed in upcoming PAN-OS releases, rates it CVSS-B 8.7 in PAN-OS when the management interface is reachable from the internet (7.1 when access is limited to a jump box), and says it is not aware of malicious exploitation against its products. ConnectWise said on its status page (21 Oct, 17:11 UTC) that it had temporarily taken the x360Recover Manager interface and Backup for Files Portal offline as a precaution in response to a critical PHP vulnerability, and that backups for all Axcient products are not impacted. According to the BBC, Finland temporarily shut down the government's public web services and the Dutch National Cyber Security Centre said it was taking its own website offline because of the flaws. UPDATE (22 Oct, 4:45 am Perth): Linux distributions have shipped fixed packages. Debian's security tracker lists php8.4 8.4.27-1~deb13u1 for Debian 13 trixie (DSA-6574-1) and php8.2 8.2.35-1~deb12u1 for Debian 12 bookworm (DLA-4848-1) as fixed. Ubuntu published USN-8948-1 and USN-8948-2 on 21 October, and its CVE page for CVE-2026-109618 lists fixes in php8.3 8.3.6-0ubuntu0.24.04.13 (24.04 LTS), php8.1 8.1.2-1ubuntu2.28 (22.04 LTS) and php8.5 8.5.4-0ubuntu1.5 (26.04 LTS), with fixes for some older releases available through Ubuntu Pro. The CVE records, published on 21 October, confirm CVSS 4.0 9.2 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) for both flaws, and CISA's enrichment of those records lists exploitation as 'none'. Neither CVE was in CISA's KEV catalog as of its 21 October 14:04 UTC update. PHP has published no new advisory since its 21 October release notice. UPDATE (22 Oct, 5:45 am Perth): Palo Alto Networks updated its advisory at 19:18 UTC on 21 October (3:18 am Perth 22 Oct) to list GlobalProtect App and Prisma Access Agent as not impacted; its FAQ says the issue strictly affects the PAN-OS management web interface (the HTTPS web UI and XML API service), affects a dataplane interface only if a management profile is attached to it, and does not affect GlobalProtect portals and gateways or the captive portal. Palo Alto still lists fixed PAN-OS and Panorama versions as 'ETA: TBD' as of 22 Oct. Red Hat's security bulletin RHSB-2026-013 rates the two flaws Important and lists Red Hat Enterprise Linux 10, 9 and 8 and Red Hat OpenShift Dev Spaces 3 as affected, saying RHEL 7 and earlier ship PHP versions that are not affected; Red Hat says some fixes are already available with more in progress, that standard RHEL deployments use PHP-FPM, where remote code execution is difficult in practice, and that environments running mod_php with default configuration are at higher risk. SUSE's page for CVE-2026-109618 lists fixed php8 8.3.36-150700.3.24.1 packages for SUSE Linux Enterprise Server 15 SP7 and its Web and Scripting module, with the overall issue still marked pending. ConnectWise said at 18:22 UTC on 21 October (2:22 am Perth 22 Oct) that x360Recover Manager and related services had been patched and restored, and that the Backup for Files Portal (Legacy Portal) remained temporarily unavailable as a security precaution. UPDATE (22 Oct, 8:30 am Perth): Palo Alto Networks' advisory timeline now also lists Cortex XSIAM and Prisma Cloud as not impacted and records that Threat IDs were released; it says customers with a Threat Prevention subscription get coverage by enabling Threat IDs 543004, 97622, 97623, 97624 and 97625 (Applications and Threats content version 9162 and later), and that for these Threat IDs to protect against the attack, management traffic must be routed through a dataplane port, the certificate for inbound management traffic replaced, that traffic decrypted and threat prevention enabled on it. Palo Alto still lists fixed PAN-OS and Panorama versions as 'ETA: TBD' as of 22 Oct. Fortinet's PSIRT advisory FG-IR-26-186 (21 Oct) says Fortinet is investigating the impact on FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard and FortiEndpoint, lists FortiOS, FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient for Linux, Windows and macOS, FortiSASE, FortiAuthenticator, FortiSwitch and FortiNAC as confirmed not impacted, and marks the issue 'Known Exploited: No'. The WA Government's Cyber Security Unit (WASOC) published advisory 20261022001 on 22 October recommending that administrators apply PHP's fixes, and said it had not received any reports of exploitation on Western Australian Government networks at the time of writing. UPDATE (22 Oct, 11:00 am Perth): Amazon Threat Intelligence says in an AWS Security Blog post (21 Oct, 22:36 UTC; 6:36 am Perth 22 Oct) that it identified a PHP2Shell exploitation attempt dating to 17 October in its MadPot honeypot telemetry, four days before public disclosure, from an IP address associated with a commercial anonymization network, and that it remains unclear how the actor acquired exploit information before disclosure. Amazon says it identified multiple proof-of-concept exploits on release day, the earliest around 02:00 UTC on 21 October, and further exploitation attempts against MadPot from other anonymized infrastructure between 02:00 and 08:00 UTC that suggested multiple actors; it says it is unclear if any of these attempts would have succeeded in real-world systems. Amazon says that once the embargo lifted at 14:00 UTC additional proof-of-concept exploits appeared within hours and were used against its sensors almost immediately, that PHP2Shell is now being broadly exploited in the wild, and that investigations should start from at least 17 October. AWS Security Bulletin 2026-143-AWS (first published 21 Oct) says AWS services are not impacted and that PHP 5.4 to 8.1 have no upstream fix; see the 23 Oct update for the status of AWS's own fixes. In Australia, according to Information Age (ACS), ASD said on Wednesday night (21 Oct) that it was 'aware of an outage that may be affecting government websites', including its own. ASD's 'ALERT UPDATE' post on X (22:51 UTC on 21 Oct; 6:51 am Perth 22 Oct), embedded in the Information Age report, says 'Patches are now available for two critical PHP vulnerabilities' and recommends that organisations using PHP identify affected systems, review official PHP guidance and apply appropriate mitigations as soon as possible. According to ABC News (22 Oct), GovCMS, which hosts many major Australian government websites, blocked direct access to its servers while keeping cached copies of public pages available; Moodle 'took its website offline as a precaution, before beginning to restore them after applying security fixes'; and Australian hosting provider VentraIP restricted some of its file uploads on customer hosting. UPDATE (23 Oct 2026, 7:45 am Perth): AWS updated Security Bulletin 2026-143-AWS at 14:00 PDT on 22 October (5:00 am Perth 23 Oct) to say its fixes have shipped: for Amazon WorkMail 'AWS has applied configuration-level controls and has completed the upgrade to PHP 8.3.36. No customer action is required'; for Elastic Beanstalk it 'has released updated PHP platform versions for all supported PHP versions (8.2 through 8.5) containing the upstream PHP fix'; updated Amazon Linux PHP packages are available for commercial regions, with non-commercial regions targeted for 22 October; and 'Updated Lightsail blueprints are now available in all regions'. AWS still says AWS services are not impacted and that PHP 5.4 to 8.1 have no upstream fix. Fortinet updated FG-IR-26-186 on 22 October: only FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS remain under investigation; FortiADC, FortiADC Manager, FortiClient EMS, FortiSIEM and FortiMonitor, among others, are now listed as confirmed not impacted; and it still marks the issue 'Known Exploited: No'.
- Product
- PHP (server-side scripting language and runtime)
- Versions
- Affected: PHP below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (PHP advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp). Fixed: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (21 Oct 2026). PHP 8.1 and older get no PHP project updates; PHP published minimal source backports for 7.4, 8.0 and 8.1. As of 21 Oct.
- CVSS
- 9.2 (CVSS 4.0, PHP) for each flaw
- Exploited in Australia?
- unknown
- Patch to
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now, or install your Linux distribution's or LTS vendor's patched package (PHP says they received the patches in advance, so check your vendor; Debian DSA-6574-1 and DLA-4848-1 and Ubuntu USN-8948-1 and USN-8948-2 are out), then restart Apache, PHP-FPM and any long-running PHP workers so the fixed runtime is loaded. Updating an application such as WordPress or Laravel does not update the PHP runtime beneath it (The Hacker News). On PHP 8.1 or older, upgrade to a supported branch or get backported fixes from your vendor; PHP has published minimal source backports for 7.4, 8.0 and 8.1. If you cannot update at once, PHP's interim measures reduce but do not remove exposure: for CVE-2026-109618 set memory_limit=-1 in a way applications cannot override (for example php_admin_value), keep post_max_size low (8M without uploads, 32M with) and enforce request-size limits at the web server or proxy, and do not use RLIMIT_AS or RLIMIT_DATA; for CVE-2026-109619 set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration and restart every worker, and on PHP 8.5 also set fatal_error_backtraces=0. Prioritise Apache mod_php servers, which PHP rates highest risk. Treat WAF rules such as Cloudflare's as a stopgap only. ASD (alert update on X, 21 Oct, as embedded by Information Age): identify affected systems, review official PHP guidance and apply appropriate mitigations as soon as possible. Palo Alto Networks PAN-OS and Panorama (all versions affected, per Palo Alto, 21 Oct): no fixed PAN-OS release yet; restrict the management interface to trusted internal IP addresses or a jump box, and Advanced Threat Prevention customers can use Threat IDs 543004, 97622, 97623, 97624 and 97625; watch the Palo Alto advisory for fixed versions. CISA (21 Oct): inventory every system running PHP, including products that bundle it, patch internet-facing systems first, take PHP-based systems offline if you cannot update immediately or run PHP 8.1 or earlier, and watch for PHP worker processes launching shells or downloading tools. Red Hat (RHSB-2026-013): RHEL 8, 9 and 10 and OpenShift Dev Spaces 3 are affected; install Red Hat's php updates as they ship, keep the php package current in layered products that pull from RHEL channels, and rebuild containers when the RHEL/UBI base images are updated. SUSE: SLES 15 SP7 php8 8.3.36-150700.3.24.1 or later. Palo Alto (22 Oct): Threat Prevention customers enable Threat IDs 543004, 97622–97625 (content 9162+); Palo Alto says they protect only when management traffic is routed through a dataplane port, the inbound management certificate is replaced, and that traffic is decrypted and inspected with threat prevention. Fortinet: watch FG-IR-26-186 for the five products still under investigation (FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR, FortiSOAR PaaS; updated 22 Oct). AWS (Security Bulletin 2026-143-AWS, updated 22 Oct 14:00 PDT): Amazon WorkMail needs no customer action; on Elastic Beanstalk, Managed Platform Updates apply the fixed PHP platform versions (8.2 to 8.5) in the next maintenance window, otherwise update the environment's platform version; apply the updated Amazon Linux PHP packages (available in commercial regions); Lightsail instances cannot be updated in place, so create new instances from the updated blueprints (now available in all regions) and migrate. Amazon also advises looking for POST requests carrying PHP_SESSION_UPLOAD_PROGRESS and investigating from at least 17 October.
Primary: PHP.net — Security advisory: Critical remote code execution vulnerabilities, update now (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; 21 Oct 2026) · Vendor: PHP.net — Upcoming Critical PHP Security Release (20 Oct 2026) · CVE: CVE-2026-109618, CVE-2026-109619 · Information Age (ACS) — Govt sites go down after AI finds 'critical' PHP vulnerabilities (22 Oct 2026; reports ASD/ACSC statements) · AWS Security Blog — Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (21 Oct 2026) · AWS Security Bulletin 2026-143-AWS — PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) (updated 22 Oct 2026) · Fortinet PSIRT FG-IR-26-186 — PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619) (updated 22 Oct 2026) · Palo Alto Networks — CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products · WASOC — PHP Critical Vulnerabilities named PHP2Shell - 20261022001 (22 Oct 2026) · ABC News — Australians face spike in data breaches after AI helps uncover 'critical' website flaw (22 Oct 2026) · ASD (@ASDGovAu) on X — ALERT UPDATE: Patches are now available for two critical PHP vulnerabilities (21 Oct 2026, 22:51 UTC)