LinkwatchTowrResource
Because PHP underpins a substantial portion of enterprise web infrastructure and CMS deployments, unauthenticated RCE vulnerabilities with active exploitation present an acute risk requiring immediate patching.
The disclosure timeline highlights the operational challenges of unplanned leaks, as the vulnerability details surfaced publicly on social media before the coordinated release date. Because configuration workarounds are ineffective, administrators must upgrade their PHP runtime packages and restart all worker processes immediately. Older installations on end-of-life branches such as PHP 7.4 through 8.1 require distribution-level backports or vendor LTS packages to remediate the exposure.
Summary generated by AI (Gemini 3.8 Flash, 27 October 2026). It may contain errors – the original source is authoritative.
Similar in content, found by the AI search.
Link:Calif Research
Calif Research has disclosed PHP2Shell, detailing two severe PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) triggered via out-of-memory states and addressed in the October 2026 security release.
VideoVideo:CURT
Two critical vulnerabilities in the PHP core engine, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), allow unauthenticated Remote Code Execution before application code even begins to execute.
Article:Wiz Research
Wiz Research has disclosed PHP2Shell, a set of critical memory-safety vulnerabilities in the core PHP engine affecting versions dating back to PHP 5.4. Tracked under CVE-2026-109618 and CVE-2026-109619 with CVSS scores up to 9.2, they enable unauthenticated remote code execution and process-memory leakage. Researchers utilised frontier AI models to rapidly build and adapt complex exploit chains across targets.
Article:Daniele Molteni, Dan Jones, and Kuber Nandwani
Cloudflare has rolled out Managed WAF rules to protect against the php2shell vulnerabilities affecting PHP 5.4 and later. The mitigations introduce full transaction detection to block exploits before responses reach requesters.
Link:The PHP team
The PHP team has released updated Windows packages for multiple PHP branches, bundling Brotli 1.2.1 to patch an out-of-bounds write vulnerability.
Link:CISA, NSA, FBI, DOE, EPA
US security agencies have issued an advisory regarding an active threat to Siemens S7 programmable logic controllers (PLCs). Threat actors are deploying AI-generated scripts disguised as legitimate monitoring tools to target exposed industrial systems.
Parts of this content were created with the assistance of AI.
