Ethical Hacking News
Two critical Remote Code Execution (RCE) flaws in PHP have been identified, rated 9.2 on the Common Vulnerability Scoring System (CVSS) v4.0 scale. The PHP core team has acknowledged the existence of these flaws and is expected to release an emergency security release. PHP users are advised to patch their systems immediately to prevent exploitation of these vulnerabilities. The leaks of the vulnerabilities and the official announcement by PHP have raised concerns among security experts, and the PHP core team is under pressure to provide a fix for the two critical RCE flaws.
The PHP 2.0 shell exploits two critical Remote Code Execution (RCE) flaws, rated 9.2 on the Common Vulnerability Scoring System (CVSS) v4.0 scale. The PHP core team has acknowledged the existence of the flaws and an emergency security release is expected to be issued. The leaked information was verified by watchTowr, and PHP published its official notice on October 21, 2026, stating that the release would be issued earlier than planned if details of the vulnerabilities became public. Approximately 884,000 internet-facing hosts with PHP versions 8.1 or older were reported on October 20, 2026. The preparation for patching includes six steps, including inventorying PHP installs and patching internet-facing systems first. WatchTowr advises to alert on suspicious php-fpm, php-cgi, httpd, or apache2 launching shells, interpreters, or download tools.
The cybersecurity landscape has been abuzz with the revelation of two unpatched critical vulnerabilities in PHP, a server-side scripting language used for web development. According to watchTowr, a reputable security research firm, the PHP 2.0 shell (PHP2Shell) exploits these two critical Remote Code Execution (RCE) flaws, rated 9.2 on the Common Vulnerability Scoring System (CVSS) v4.0 scale. The PHP core team has acknowledged the existence of these flaws, and an emergency security release is expected to be issued.
The first flaw, identified as CVE-2026-109618, and the second flaw, identified as CVE-2026-109619, were leaked on October 20, 2026, before the official announcement by PHP. The leaked information included the existence of the flaws, a score, and a date, but the actual mechanics of the vulnerabilities were not disclosed. The leaked post also mentioned that the flaws affected versions of PHP from 5 onward, but this claim has been disputed by watchTowr, which states that the scope of the affected versions has not been confirmed by an official vendor advisory.
The leaked information was verified by watchTowr, which posted a notice on X, stating that the leaked information was real and that the two flaws were under embargo. PHP published its official notice on October 21, 2026, stating that the release would be issued earlier than initially planned if details of the vulnerabilities became public or if evidence of active exploitation appeared in the wild.
According to Mallory, a security company that monitored internet-facing hosts, approximately 884,000 internet-facing hosts with HTTP banners reported a PHP version of 8.1 or older on October 20, 2026. This number represents about 59% of the roughly 1.5 million hosts that reported any version. PHP has not published a workaround for the vulnerabilities, and the preparation for patching comes down to six steps.
The steps include inventorying every PHP install, including PHP bundled in vendor appliances, Windows software, and control panels such as cPanel and Plesk. It is essential to be ready to upgrade at 14:00 UTC and to patch internet-facing systems first. If patching cannot be done at once, it is recommended to isolate internet-facing applications from public networks until a fix is available. Additionally, watchTowr advises to alert on php-fpm, php-cgi, httpd, or apache2 launching shells, interpreters, or download tools. On Linux servers without endpoint detection, Florian Roth's process-watcher logs every program a PHP process starts, with its command line.
If a security issue is found, it is crucial to isolate the server, preserve the web server and PHP logs, and look for web shells, new files in the web root, new cron jobs, scheduled tasks, and accounts. Huntress, a partner environment, has not seen exploitation of the flaws in its partner environments as of October 20, 2026. watchTowr's FAQ lists exploitation as none reported as of October 21 and the flaws as not in CISA's Known Exploited Vulnerabilities catalog.
In a related development, Akamai saw exploit attempts against its honeypot servers within 24 hours of the June 2024 disclosure of CVE-2024-4577, a PHP flaw in CGI mode on Windows. The PHP core team is expected to release the fixes for the two unpatched critical vulnerabilities, which will provide much-needed security patches for PHP users.
The PHP 2.0 shell exploits the two critical Remote Code Execution (RCE) flaws, rated 9.2 on the Common Vulnerability Scoring System (CVSS) v4.0 scale. The PHP core team has acknowledged the existence of these flaws, and an emergency security release is expected to be issued. The leaked information was verified by watchTowr, which states that the leaked information was real and that the two flaws were under embargo. PHP published its official notice on October 21, 2026, stating that the release would be issued earlier than initially planned if details of the vulnerabilities became public or if evidence of active exploitation appeared in the wild.
Related Information:
https://www.ethicalhackingnews.com/articles/Two-Unpatched-Critical-PHP-RCE-Flaws-Trigger-Emergency-Security-Alert-A-Comprehensive-Analysis-ehn.shtml
https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
https://nvd.nist.gov/vuln/detail/CVE-2026-109618
https://www.cvedetails.com/cve/CVE-2026-109618/
https://nvd.nist.gov/vuln/detail/CVE-2026-109619
https://www.cvedetails.com/cve/CVE-2026-109619/
Published: Wed Oct 21 00:40:41 2026 by llama3.2 3B Q4_K_M
