Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [ACTIVE] · [TECHNOLOGY]
3 clusters · 845 sources · 7 days · First seen · Last updated
PHP emergency patching and RCE vulnerability response
Overview
The PHP security team has released emergency patches to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. The accelerated release follows a leak of vulnerability details and the emergence of ‘PHP2Shell’, a proof-of-concept exploit tool. Security researchers and agencies, including the German BSI, CERT-EU, the US FBI, and the NSA, have warned that these flaws could allow unauthenticated attackers to gain full control over web servers. The vulnerabilities, which were discovered with the assistance of artificial intelligence including ‘OpenAI’s GPT-5.6 Sol’ and Google’s Gemini, have triggered a global cybersecurity emergency. Because PHP powers approximately 70% of the web—including platforms such as WordPress, Drupal, and Joomla—the potential impact is vast. The disclosure process has been described as contentious. The PHP Foundation noted that while several organizations agreed to a coordinated release, cybersecurity firm Chainguard allegedly broke the embargo. This premature disclosure reportedly allowed attackers to study the fixes and develop proofs-of-concept before many defenders could update. Following this, Cloudflare and Amazon reported that hacking attempts surged into the millions, with Amazon’s MadPot honeypot logs identifying exploitation attempts as early as October 17, 2026.
In Germany, the Federal Office for Information Security (BSI) issued a Level 3 ‘Orange’ cybersecurity warning. The BSI noted that leaked technical details granted attackers a significant head start. The vulnerabilities affect various installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, impacting versions dating back to PHP 5. In response, several major German institutions, such as the Charité hospital in Berlin, universities, fire departments, and government agencies, were forced to take their websites offline as a precaution. This incident has highlighted the necessity for robust Business Continuity Management (BCM) to handle the operational impact of emergency IT shutdowns.
Entities
PHP · BSI · NSA · Australian Cyber Security Centre · WatchTowr
Claims
What the coverage asserts, and how many sources carry each claim.
Coverage disagrees
Sources make claims that cannot both be true. CLSTR reports the disagreement; it does not decide who is right.
-
"Only PHP versions 8.2 through 8.5 will receive official security patches." bitnewsbot.com · journalducoin.com · www.blogspan.net · administrator.de · www.drweb.de
vs
"Patches were also provided for end-of-life versions 7.4, 8.0, and 8.1." atmarkit.itmedia.co.jp · dev.to · congnghevadoisong.vn
One claim states only versions 8.2 through 8.5 receive patches, while the other claims patches were provided for versions 7.4, 8.0, and 8.1.
- [DISPUTED] Only PHP versions 8.2 through 8.5 will receive official security patches. bitnewsbot.com · journalducoin.com · www.blogspan.net · administrator.de · www.drweb.de
- [DISPUTED] Patches were also provided for end-of-life versions 7.4, 8.0, and 8.1. atmarkit.itmedia.co.jp · dev.to · congnghevadoisong.vn
- [● 46 SOURCES] Two critical security vulnerabilities exist in the PHP programming language. www.donanimhaber.com · www.odatv.com · dokuzeylul.com · www.yenisafak.com · www.allgaeuer-zeitung.de · +40 more
- [● 43 SOURCES] The flaws allow for remote code execution (RCE) without user authentication. www.gazetebirlik.com · www.odatv.com · dokuzeylul.com · www.yenisafak.com · forbesliberia.com · +37 more
- [● 39 SOURCES] The vulnerabilities are identified by the codes CVE-2026-109618 and CVE-2026-109619. www.odatv.com · dokuzeylul.com · www.yenisafak.com · forbesliberia.com · www.miperiodico.com.ar · +33 more
- [● 37 SOURCES] The two vulnerabilities have a CVSS v4.0 rating of 9.2. cybernoz.com · weekly.ascii.jp · arstechnica.com · www.it-boltwise.de · www.nouvelles-du-monde.com · +32 more
- [● 30 SOURCES] The vulnerabilities, named PHP2Shell, allow attackers to execute code without a username or password. www.zimcelebsofficial.com · via.ritzau.dk · it-online.co.za · dantri.com.vn · brnenska.drbna.cz · +25 more
Timeline
-
[TECHNOLOGY] 3 sourcesPHP2Shell vulnerabilities trigger widespread web service shutdowns
Critical ‘PHP2Shell’ vulnerabilities in the PHP engine have forced major German institutions, including hospitals and government agencies, to take websites offline to prevent remote code execution.
-
[TECHNOLOGY] 843 sourcesPHP2Shell vulnerabilities trigger global cybersecurity alert
Critical PHP vulnerabilities known as ‘PHP2Shell’ have forced global organizations and governments to take websites offline to prevent remote code execution attacks discovered via AI.
-
[TECHNOLOGY] 2 sourcescurl project to make low and medium vulnerability reports public
Starting October 26, 2026, the curl project will publish LOW and MEDIUM severity vulnerability reports as public GitHub issues to manage an increasing volume of security submissions.
Sources
112vdg.nl · 14ymedio.com · 1zwolle.nl · 20minutos.com.mx · 360mozambique.com · 360stepeni.mk · 3djuegos.com · 44malatyahaber.com · 6abc.com · 7news.com.au · a-blogcms.jp · aajtak.com · abbl.lu · abc11.com · abc13.com · abc30.com · abc7.com · abcnews.al · actu.fr · actualidad.rt.com · actualidadecommerce.com · ad-hoc-news.de · administrator.de · adnKronos.com · aeiou.pt · aftenbladet.no · agefi.fr · agora-web.jp · airliners.de · akhbarona.com · aksam.com.tr · alagoas24horas.com.br · alba24.ro · albrandswaardsdagblad.nl · alfalfalfa.com · alhaurindelatorre.com · allgaeuer-anzeigeblatt.de · allgaeuer-zeitung.de · alltagsmagazin.de · aloco.ch · alpinerecreation.com · alqamar.info · alyaoum24.com · antiguatribune.com · appinn.com · applech2.com · arabic.euronews.com · archive.in.gr
This summary has been updated 45 times: see revision history