CONNECT WITH US
Cyber Security

Cyber Security

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

The Hacker News logo

Published on

Add as a preferred source on Google
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server.

The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own code is secure. The risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code runs.

Both flaws are rated 9.2 on the CVSS v4.0 scale and carry the identifiers CVE-2026-109618 and CVE-2026-109619. PHP published them around the scheduled release time of 14:00 UTC on October 21, a day after details leaked ahead of a planned October 22 disclosure.

Researchers at Wiz, Calif, and OpenAI found and reported the flaws, which affect nearly every PHP version back to PHP 5.4.

Every PHP installation that serves web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, according to the PHP security advisory.

Because the flaws are in the engine rather than in any site's code, even a simple "Hello World" page on a vulnerable PHP version can be attacked.

The advisory singles out mod_php as the highest risk, with a demonstrated exploit in which a single unauthenticated request triggers the attack before any application code runs. PHP-FPM behaves differently, because it shuts the worker down when a request fails early in setup.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.