Ethical Hacking News
PHP has announced an emergency security release to address two critical remote code execution flaws, dubbed php2shell, that have been leaked online. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been rated 9.2 under the Common Vulnerability Scoring System (CVSS) version 4.0, indicating a high severity level. This announcement has prompted PHP users to prepare for the upcoming security release, as administrators are advised to identify their PHP installations, prepare the updates, and avoid leaving internet-facing systems on unsupported versions without additional protection.
PHP has announced an emergency security release to address two critical RCE flaws, php2shell. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have a severity level of 9.2 and allow remote code execution on affected servers. The security release is scheduled for October 21, 2026, with reserved dates for earlier releases if technical details become public or if active exploitation is detected. PHP users are advised to identify their installations, prepare updates, and avoid leaving internet-facing systems on unsupported versions without protection. About 884,000 internet-facing hosts are vulnerable to the php2shell vulnerabilities, representing 59% of the total disclosed hosts. Security experts recommend monitoring process activity, investigating suspicious behavior, and isolating affected servers until a fix is available.
PHP has announced an emergency security release to address two critical remote code execution (RCE) flaws, dubbed php2shell, that have been leaked online. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been rated 9.2 under the Common Vulnerability Scoring System (CVSS) version 4.0, indicating a high severity level.
Researchers have confirmed that the vulnerabilities allow attackers to execute code remotely on affected servers, which has raised concerns about the potential risks to exposed and unsupported systems. PHP's security team has scheduled the release for October 21, 2026, at 14:00 UTC, and has reserved the right to release earlier if technical details become public or if evidence of active exploitation appears in the wild.
The announcement has prompted PHP users to prepare for the upcoming security release, as administrators are advised to identify their PHP installations, prepare the updates, and avoid leaving internet-facing systems on unsupported versions without additional protection. The scope of the affected versions is not yet confirmed, and PHP's supported versions policy adds another layer of complexity, as older branches no longer receive security updates from the PHP project.
Researchers have identified a significant number of internet-facing hosts that are vulnerable to the php2shell vulnerabilities, with Mallory's analysis revealing that approximately 884,000 hosts report PHP 8.1 or an older version, representing roughly 59% of the 1.5 million hosts that disclosed a PHP version in their HTTP banners. This highlights the need for PHP users to prioritize their systems, especially those running business-critical applications or processing sensitive information.
As the situation continues to unfold, security experts emphasize the importance of monitoring process activity, investigating suspicious behavior, and isolating affected servers. The CERT-EU security advisory recommends identifying PHP-based applications and preparing to patch as soon as fixed versions become available. In the absence of an immediate fix, organizations are advised to consider isolating internet-facing applications from public networks until a fix can be applied.
The emergence of the php2shell vulnerabilities serves as a reminder of the ongoing threat landscape, where vulnerabilities are constantly being discovered, and attackers are becoming increasingly sophisticated in their methods. As the PHP community prepares for this security release, it is essential to recognize the potential risks and take proactive measures to protect systems and data.
Related Information:
https://www.ethicalhackingnews.com/articles/PHP-Prepares-Emergency-Fixes-for-Two-Critical-Remote-Code-Execution-Flaws-A-Growing-Concern-for-PHP-Users-ehn.shtml
https://securityaffairs.com/201403/security/php-prepares-emergency-fixes-for-two-critical-remote-code-execution-flaws.html
https://securityarsenal.com/blog/php-emergency-patches-for-two-critical-flaws-pre-disclosure-hardening-detection-and-patch-validation-guide
Published: Wed Oct 21 05:58:08 2026 by llama3.2 3B Q4_K_M
