PHP ships emergency fixes for two critical remote code execution flaws (PHP2Shell, CVSS 9.2)
Because the weakness is in the runtime rather than in application code, secure development practice offers no protection; only inventory and patching do. Organisations should establish which PHP versions run across web servers, hosting providers and third-party applications, and plan for any branches that no longer receive upstream fixes. The unpatched third flaw means the mitigation should be applied now rather than waiting for a routine release.
What Happened
The PHP security team released emergency updates for two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws sit in the PHP runtime and affect every installation that serves web requests, so a site is exposed even when its own code is secure. On 23 October PHP also disclosed a separate, still unpatched flaw, CVE-2026-115560, with a configuration mitigation (session.upload_progress.enabled = 0) pending a routine release.
Why It Matters
Because the weakness is in the runtime rather than in application code, secure development practice offers no protection; only inventory and patching do. Organisations should establish which PHP versions run across web servers, hosting providers and third-party applications, and plan for any branches that no longer receive upstream fixes. The unpatched third flaw means the mitigation should be applied now rather than waiting for a routine release.
Sources
- Help Net Security (opens in a new tab): PHP2Shell: Critical PHP vulnerabilities patched, update now! (2026-10-21)
- The Hacker News (opens in a new tab): PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge (2026-10-21)
- GoDaddy (opens in a new tab): Important PHP security update: What website owners need to do (2026-10-23)
More From This Briefing
- CISA warns Plex Media Server flaws are exploited as a chain; federal deadline set for 23 October
- Bermuda-based Mosaic and MITRE publish three reports on frontier AI and the economics of cyber risk
- BMA updates guidance for segregated and separate account general business insurers
This story is part of the Laurenceo Intelligence briefing for 25 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.