N環球 
"PHP2Shell": PHP ships emergency patches for two critical CVSS-9.2 flaws enabling unauthenticated remote code execution
PHP released emergency updates on October 21 fixing two critical flaws collectively dubbed PHP2Shell (CVE-2026-109618, CVE-2026-109619), found by researchers at Wiz, Calif and OpenAI. Details leaked ahead of coordinated disclosure, and Cloudflare observed real attacks before the patch shipped. Every PHP installation serving web requests is affected.
Why it matters
This is one of the most severe web vulnerabilities in years. PHP powers a large share of the world's websites (WordPress, Drupal, Joomla), and this time the flaw sits in the language engine itself — even a perfectly written site offers no protection. An attacker needs no account; a single request can yield code execution on the server.
It is also the sharpest illustration yet of AI's dual role in security research: Wiz says the flaws had lurked for decades, and demonstrating exploitability required a chain 'at the edge of what human researchers could practically achieve.' Frontier AI models substantially reduced that barrier, turning a longstanding flaw into a working exploit.
Full report
PHP's security team released emergency updates on October 21 fixing CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 and collectively named PHP2Shell. Both stem from corrupted memory state when a request ends abnormally, and both can be exploited by unauthenticated attackers to achieve remote code execution.
Every PHP installation serving web requests is affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The team says risk is highest for mod_php, where a demonstrated exploit triggers before any application code runs. One flaw can even let an attacker read worker memory holding other requests' passwords, tokens and API keys.
The flaws were found by researchers at Wiz, Calif, OpenAI (a partner in its Patch the Planet programme) and Quarkslab. Technical details leaked on October 20 ahead of the planned coordinated disclosure, prompting PHP to release a day early. Cloudflare said it observed attack traffic against its customers before the patch shipped and activated WAF rules on October 21. Several Dutch and Japanese sites (including the Dutch DigiD service and the House of Representatives website) went offline as a precaution.
Admins are urged to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately; PHP 7 and earlier no longer receive official updates.
💬 Comments
No comments yet. Be the first!