Update, 10/21/2026, 9:55 a.m.: The patches have been released, with fixes shipped as versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, covering the supported branches, 8.2 through 8.5. Our original story is below. The PHP project is preparing an unscheduled security release for Wednesday to fix two vulnerabilities it rates as critical after details of the flaws leaked online and a major internet infrastructure company reported early attacks.
Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities
About this summary. This is a short excerpt from the description that CyberScoop published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
Source attribution: headline and facts are from CyberScoop (cyberscoop.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
PHP2Shell: Why websites are going offline for emergency security updates
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted…
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that…
Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners…
PHP2Shell Exploit Tooling Found on Exposed Attacker Server
SOCRadar Threat Intelligence Unit (STRU) researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed through an…
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP…
Cloudflare deploys protections against php2shell vulnerability
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The…