Flash News

PHP has had a rough week. Two critical vulnerabilities, collectively dubbed PHP2Shell, prompted emergency security releases on 21 October 2026. Tracked as CVE-2026-109618 and CVE-2026-109619, both carry a severity score of 9.2/10 and can allow attackers to execute code on vulnerable servers without logging in.

The disclosure process made matters worse. According to the PHP Foundation, leaked vulnerability identifiers and an accidentally published demonstration video disrupted the coordinated release, bringing patches forward by a day. The Foundation also acknowledged that the underlying problem behind one flaw had first surfaced in 2024, describing delays in resolving it as a “structural failure” involving difficult technical decisions and insufficient resources.

Meanwhile, Amazon reported an exploitation attempt against its monitoring infrastructure dating back to 17 October, before public disclosure. It cautioned that whether those early attempts would have succeeded against real systems remained unclear.

Fixes are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with distribution-specific updates also available through vendors. Administrators should patch urgently: configuration changes alone do not fully address both flaws.

For WordPress owners, updating plugins or WordPress itself will not fix the underlying PHP vulnerability. Check with your hosting provider that the server’s PHP installation has received the security update.