[CLSTR]
< Back to all clusters
[TECHNOLOGY] · Germany, France, Netherlands, Finland, Türkiye · 4 sources

started · updated

Part of situation: Escalation of PHP2Shell exploitation and new RCE discovery (6 clusters)

Critical PHP vulnerabilities trigger global security responses

PHP vulnerabilities remote code execution cybersecurity PHP Foundation CVE-2026-109618

Security researchers have identified two critical vulnerabilities in PHP, designated as CVE-2026-109618 and CVE-2026-109619, which allow for unauthenticated remote code execution (RCE). The flaws, which received a CVSS v4.0 score of 9.2, enable attackers to execute code on web servers without requiring a username or password.

In response to the discovery, the PHP Foundation released patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21. The disclosure process faced scrutiny after Chainguard published fixes several hours before the coordinated release, an action the PHP Foundation characterized as an embargo breach. While the Foundation stated it had not identified a functional exploit at the time of public disclosure, Amazon reported that its MadPot honeypot detected an attempted exploit on October 17.

Global impact has been noted, with several European countries, including Germany, France, the Netherlands, and Finland, temporarily taking certain websites offline as a precaution. In Turkey, the Cybersecurity Presidency has initiated national security scans and urged public and private institutions to review their systems to mitigate the risk of exploitation.

Entities

Amazon · Ankara · Ankara Water and Sewerage Administration · Bitdefender · Chainguard · Cybersecurity Presidency of Türkiye · Dan Lorenc · PHP · PHP Foundation · Wiz

Claims

What the coverage asserts, and how many sources carry each claim.

  • [○ 1 SOURCE] Chainguard published fixes approximately 6 hours before the coordinated PHP release. www.tokenpost.com
  • [○ 1 SOURCE] Germany, France, the Netherlands, and Finland temporarily closed some websites due to the vulnerabilities. www.yeniyolgazetesi.com
  • [● 2 SOURCES] PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were identified. www.yeniyolgazetesi.com · www.tokenpost.com
  • [○ 1 SOURCE] Turkey's Cybersecurity Presidency launched national security scans. www.yeniyolgazetesi.com
  • [○ 1 SOURCE] Patches were released for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. www.tokenpost.com
  • [○ 1 SOURCE] The vulnerabilities have a CVSS v4.0 score of 9.2. www.tokenpost.com
  • [○ 1 SOURCE] Amazon's MadPot honeypot detected an attempted exploit on October 17. www.tokenpost.com
  • [○ 1 SOURCE] The flaws allow unauthenticated remote code execution (RCE). www.tokenpost.com

Sources

Türkiye'de 161 uzaktan erişim sistemi iddiası: "Ankara'nın suyunu tek tuşla kapatabilirim" [sonsoz.com.tr]
PHP’deki Kritik Açıklara Karşı Kurumların Vakit Kaybetmeden Alması Gereken 5 Acil Önlem [www.yeniyolgazetesi.com]
Chainguard CEO Says Suspected Exploitation Prompted Early PHP Disclosure | TokenPost [www.tokenpost.com]
Hormuz Cable Warning Puts Satellite Backup in Focus. [econotimes.com]