# PHP emergency patching and RCE vulnerability response

> Live situation record from CLSTR: https://clstr.news/situations/software-vulnerability-disclosure-and-patching-updates
> Updated: 2026-10-26T12:16:38.000Z. Sources: 845. Developments: 3.

The PHP security team has released emergency patches to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. The accelerated release follows a leak of vulnerability details and the emergence of ‘PHP2Shell’, a proof-of-concept exploit tool. Security researchers and agencies, including the German BSI, CERT-EU, the US FBI, and the NSA, have warned that these flaws could allow unauthenticated attackers to gain full control over web servers. The vulnerabilities, which were discovered with the assistance of artificial intelligence including ‘OpenAI’s GPT-5.6 Sol’ and Google’s Gemini, have triggered a global cybersecurity emergency. Because PHP powers approximately 70% of the web—including platforms such as WordPress, Drupal, and Joomla—the potential impact is vast. The disclosure process has been described as contentious. The PHP Foundation noted that while several organizations agreed to a coordinated release, cybersecurity firm Chainguard allegedly broke the embargo. This premature disclosure reportedly allowed attackers to study the fixes and develop proofs-of-concept before many defenders could update. Following this, Cloudflare and Amazon reported that hacking attempts surged into the millions, with Amazon’s MadPot honeypot logs identifying exploitation attempts as early as October 17, 2026.

In Germany, the Federal Office for Information Security (BSI) issued a Level 3 ‘Orange’ cybersecurity warning. The BSI noted that leaked technical details granted attackers a significant head start. The vulnerabilities affect various installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, impacting versions dating back to PHP 5. In response, several major German institutions, such as the Charité hospital in Berlin, universities, fire departments, and government agencies, were forced to take their websites offline as a precaution. This incident has highlighted the necessity for robust Business Continuity Management (BCM) to handle the operational impact of emergency IT shutdowns.

## Claims

- Only PHP versions 8.2 through 8.5 will receive official security patches. (disputed by 5 sources)
- Patches were also provided for end-of-life versions 7.4, 8.0, and 8.1. (disputed by 3 sources)
- Two critical security vulnerabilities exist in the PHP programming language. (corroborated by 46 sources)
- The flaws allow for remote code execution (RCE) without user authentication. (corroborated by 43 sources)
- The vulnerabilities are identified by the codes CVE-2026-109618 and CVE-2026-109619. (corroborated by 39 sources)
- The two vulnerabilities have a CVSS v4.0 rating of 9.2. (corroborated by 37 sources)
- The vulnerabilities, named PHP2Shell, allow attackers to execute code without a username or password. (corroborated by 30 sources)

## Timeline

### 2026-10-26: PHP2Shell vulnerabilities trigger widespread web service shutdowns

Critical ‘PHP2Shell’ vulnerabilities in the PHP engine have forced major German institutions, including hospitals and government agencies, to take websites offline to prevent remote code execution.

3 sources. https://clstr.news/cluster/php2shell-vulnerabilities-trigger-widespread-web-service-shutdowns

### 2026-10-20: PHP2Shell vulnerabilities trigger global cybersecurity alert

Critical PHP vulnerabilities known as ‘PHP2Shell’ have forced global organizations and governments to take websites offline to prevent remote code execution attacks discovered via AI.

843 sources. https://clstr.news/cluster/php-security-team-announces-emergency-patches-for-two-critical-vulnerabilities

### 2026-10-20: curl project to make low and medium vulnerability reports public

Starting October 26, 2026, the curl project will publish LOW and MEDIUM severity vulnerability reports as public GitHub issues to manage an increasing volume of security submissions.

2 sources. https://clstr.news/cluster/curl-project-to-make-low-and-medium-vulnerability-reports-public

---
Cite as: PHP emergency patching and RCE vulnerability response. CLSTR, https://clstr.news/situations/software-vulnerability-disclosure-and-patching-updates