PHP2Shell Bugs

PHP

Security teams are scrambling to remediate two critical PHP vulnerabilities.

Do this now

Upgrade PHP to 8.5.12, 8.4.27 or 8.3.36, matching your release line (more lines in the table).

Fix it

PHP

On 8.2.xUpgrade to PHP 8.2.35
On 8.2.xUpgrade to PHP 8.2.35
On 8.3.xUpgrade to PHP 8.3.36
On 8.3.xUpgrade to PHP 8.3.36
On 8.4.xUpgrade to PHP 8.4.27
On 8.4.xUpgrade to PHP 8.4.27
On 8.5.xUpgrade to PHP 8.5.12
On 8.5.xUpgrade to PHP 8.5.12

Also affects (downstream advisories): paloaltonetworks pan-os. Check those vendors' own fixes.

First seen: 21 Oct 2026
Last update: 23 Oct 2026, 17:50 UTC
Fixed in: 8.5.12
8.4.27
8.3.36
8.2.35
Identifiers: CVE-2026-109618
CVE-2026-109619
CVSS: 9.8
Source: news
On the menu as: PHP

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## PHP2Shell Bugs
Severity: critical. Patch status: patched.
Affected: PHP
Fixed in: 8.5.12, 8.4.27, 8.3.36, 8.2.35
Ids: CVE-2026-109618, CVE-2026-109619

Security teams are scrambling to remediate two critical PHP vulnerabilities.

## Steps
1. Search the repo, its CI and infra config for PHP. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-109618") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/ https://blog.gitguardian.com/php2shell-php-vulnerability-secrets/ https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1 https://security.paloaltonetworks.com/CVE-2026-109618 https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching https://www.wiz.io/blog/php2shell-php-rce https://www.theregister.com/security/2026/10/21/php-devs-publish-critical-bug-fix-as-site-owners-warned-pull-em-offline-if-youre-unpatched/5304519 https://socket.dev/blog/php-critical-rce-patches?utm_medium=feed https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry https://isc.sans.edu/diary/rss/33440 https://www.php.net/index.php#2026-10-21-5 https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell https://fortiguard.fortinet.com/psirt/FG-IR-26-186 https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/ https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
https://pwned.coffee/i/php2shell-bugs

Timeline

23 Oct 2026, 17:50 UTC
Patches released for PHP core RCE vulnerability
23 Oct 2026, 17:50 UTC
PHP2Shell: Critical PHP vulnerabilities, affected versions and fixes
23 Oct 2026, 17:50 UTC
Reported by php.net: Security advisory: Critical remote code execution vulnerabilities, update now
23 Oct 2026, 16:19 UTC
Early PoC exploits are available before the patch.
23 Oct 2026, 16:17 UTC
PHP releases emergency patches for the vulnerabilities.
23 Oct 2026, 16:17 UTC
Exploits have already been published for the vulnerabilities.
23 Oct 2026, 16:17 UTC
CISA strongly urges organizations to immediately patch the vulnerabilities.
23 Oct 2026, 16:04 UTC
Impact on Palo Alto Networks products
23 Oct 2026, 16:03 UTC
Reported by sec.cloudapps.cisco.com: Vulnerabilities in PHP Affecting Cisco Products: October 2026
23 Oct 2026, 08:43 UTC
Reported by feeds.feedburner.com: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
23 Oct 2026, 08:42 UTC
Responding to php2shell PHP vulnerability
23 Oct 2026, 08:42 UTC
New PHP2Shell scanner checks for vulnerabilities
21 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Overheard “PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware” source
Overheard “PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge” source
Fix by release line: Product Affected Fixed in Source
PHP < 8.5.12 8.5.12 GitHub advisory
PHP < 8.4.27 8.4.27 GitHub advisory
PHP < 8.3.36 8.3.36 GitHub advisory
PHP < 8.2.35 8.2.35 GitHub advisory
PHP 8.5.* to before 8.5.12 8.5.12 CVE record (CNA)
PHP 8.4.* to before 8.4.27 8.4.27 CVE record (CNA)
PHP 8.3.* to before 8.3.36 8.3.36 CVE record (CNA)
PHP 8.2.* to before 8.2.35 8.2.35 CVE record (CNA)
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (NVD) for CVE-2026-109618
Last checked: 24 Oct 2026, 17:17 UTC

Product	Affected	Fixed in	Source
PHP	< 8.5.12	8.5.12	GitHub advisory
PHP	< 8.4.27	8.4.27	GitHub advisory
PHP	< 8.3.36	8.3.36	GitHub advisory
PHP	< 8.2.35	8.2.35	GitHub advisory
PHP	8.5.* to before 8.5.12	8.5.12	CVE record (CNA)
PHP	8.4.* to before 8.4.27	8.4.27	CVE record (CNA)
PHP	8.3.* to before 8.3.36	8.3.36	CVE record (CNA)
PHP	8.2.* to before 8.2.35	8.2.35	CVE record (CNA)

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone very hot coffee