PHP maintainers have released two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
New Serious PHP Vulnerabilities Released and Patched
About this summary. This is a short excerpt from the description that Schneier on Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.schneier.com/blog/archives/2026/10/new-serious-php-vulnerabilities-released-and-patched.html
Source attribution: headline and facts are from Schneier on Security (schneier.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit
Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and…
Introducing the Cloudflare PHP Capture the Flag challenge
Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised, creating the possibility of forged…
The adversary economy: How threat actors are reacting to PHP2Shell
Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure…
PHP2Shell Exploit Tooling Found on Exposed Attacker Server
SOCRadar Threat Intelligence Unit (STRU) researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed through an…
PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports
AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive. Attackers…
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote…