Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
Today's PHP Security Release, and How We're Strengthening PHP Security
Describing the story behind how critical security vulnerabilities were found and fixed.
Today's PHP Security Release, and How We're Strengthening PHP Security
Describing the story behind how critical security vulnerabilities were found and fixed.
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.
PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619)
PHP fixed two remote code execution bugs on October 21. They affect PHP 5.4 and later. An attack needs specific knowledge of the target server and specific c...
PHP ships emergency patches for critical PHP2Shell flaws
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.
Your Sites Are Protected Against the PHP2Shell Vulnerabilities
Today, the PHP project released security updates for two critical vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell.” Both are rated…
Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
On October 20, the PHP security team announced an out-of-band security release for Wednesday, October 21, 2026 at 14:00 UTC , fixing two cr...
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
PHP developers issue updates to fix vulnerabilities, says flaw was found in 2024
Developers of the PHP programming language said a set of new updates fixing two previously identified critical vulnerabilities was now live, and acknowledged a delay in addressing a previously identified flaw.
Today's PHP Security Release, and How We're Strengthening PHP Security
247 votes, 49 comments. We have posted more information about today's security releases, including the sequence of events that led to the discovery…
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
PHP CVE-2026-109618 and CVE-2026-109619: how to apply the patches
Install the fixed PHP for CVE-2026-109618 and CVE-2026-109619 on Ubuntu, Debian and RHEL, restart the right processes, and roll back the early mitigations.
Why everything was broken yesterday
Unsolicited tech advice about the two issues (PHP, compromised certificates) that, separately, each pose some security risks and are worth attending to.
