[CLSTR]
< Back to situation

[REVISION HISTORY]

PHP emergency patching and RCE vulnerability response

Updated 45 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-25 19:51 UTC → 2026-10-26 14:13 UTC · added removed

The PHP security team has released emergency patches to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. The accelerated release follows a leak of vulnerability details and the emergence of ‘PHP2Shell’, a proof-of-concept exploit tool. Security researchers and agencies, including the German BSI, CERT-EU, the US FBI, and the NSA, have warned that these flaws could allow unauthenticated attackers to gain full control over web servers. The vulnerabilities, which were discovered with the assistance of artificial intelligence including ‘OpenAI’s GPT-5.6 Sol’ and Google’s Gemini, have triggered a global cybersecurity emergency. Because PHP powers approximately 70% of the web—including platforms such as WordPress, Drupal, and Joomla—the potential impact is vast. The disclosure process has been described as contentious. The PHP Foundation noted that while several organizations agreed to a coordinated release, cybersecurity firm Chainguard allegedly broke the embargo. This premature disclosure reportedly allowed attackers to study the fixes and develop proofs-of-concept before many defenders could update. Following this, Cloudflare and Amazon reported that hacking attempts surged into the millions, with Amazon’s MadPot honeypot logs identifying exploitation attempts as early as October 17, 2026. As the crisis evolves, the impact has expanded globally. In Germany, the United Kingdom, over 30 public services were taken offline Federal Office for Information Security (BSI) issued a Level 3 ‘Orange’ cybersecurity warning. The BSI noted that leaked technical details granted attackers a significant head start. The vulnerabilities affect various installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, impacting versions dating back to prevent breaches. PHP 5. In the Netherlands, services response, several major German institutions, such as the Port of Rotterdam and the national football federation were impacted. Other affected regions include France, Belgium, the Czech Republic, Japan, Finland, and Denmark. In Hungary, the magyarorszag.hu portal Charité hospital in Berlin, universities, fire departments, and other government sites agencies, were temporarily taken offline. Additionally, services from Wikimedia, including Wikipedia, and forced to take their websites offline as a precaution. This incident has highlighted the BBC have experienced disruptions. New reports indicate that necessity for robust Business Continuity Management (BCM) to handle the Democratic Republic operational impact of the Congo has also implemented preventive measures, including temporarily disconnecting services from the internet. emergency IT shutdowns.

Versions

  1. 2026-10-26 14:13 UTC PHP emergency patching and RCE vulnerability response
  2. 2026-10-25 19:51 UTC PHP emergency patching and RCE vulnerability response
  3. 2026-10-24 13:09 UTC PHP emergency patching and RCE vulnerability response
  4. 2026-10-24 05:12 UTC PHP emergency patching and RCE vulnerability response
  5. 2026-10-24 03:11 UTC PHP emergency patching and RCE vulnerability response
  6. 2026-10-23 23:42 UTC PHP emergency patching and RCE vulnerability response
  7. 2026-10-23 15:05 UTC PHP emergency patching and RCE vulnerability response
  8. 2026-10-23 14:07 UTC PHP emergency patching and RCE vulnerability response
  9. 2026-10-23 13:13 UTC PHP emergency patching and RCE vulnerability response
  10. 2026-10-23 12:51 UTC PHP emergency patching and RCE vulnerability response
  11. 2026-10-23 10:37 UTC PHP emergency patching and RCE vulnerability response
  12. 2026-10-23 09:57 UTC PHP emergency patching and RCE vulnerability response
  13. 2026-10-23 09:16 UTC PHP emergency patching and RCE vulnerability response
  14. 2026-10-23 09:12 UTC PHP emergency patching and RCE vulnerability response
  15. 2026-10-23 09:02 UTC PHP emergency patching and RCE vulnerability response
  16. 2026-10-23 08:45 UTC PHP emergency patching and RCE vulnerability response
  17. 2026-10-23 08:24 UTC PHP emergency patching and RCE vulnerability response
  18. 2026-10-23 07:36 UTC PHP emergency patching and RCE vulnerability response
  19. 2026-10-23 05:37 UTC PHP emergency patching and RCE vulnerability response
  20. 2026-10-23 05:24 UTC PHP emergency patching and RCE vulnerability response
  21. 2026-10-23 05:12 UTC PHP emergency patching and RCE vulnerability response
  22. 2026-10-23 04:47 UTC PHP emergency patching and RCE vulnerability response
  23. 2026-10-23 04:31 UTC PHP emergency patching and RCE vulnerability response
  24. 2026-10-23 04:19 UTC PHP emergency patching and RCE vulnerability response
  25. 2026-10-23 02:42 UTC PHP emergency patching and RCE vulnerability response
  26. 2026-10-23 02:09 UTC PHP emergency patching and RCE vulnerability response
  27. 2026-10-23 01:29 UTC PHP emergency patching and RCE vulnerability response
  28. 2026-10-23 01:03 UTC PHP emergency patching and RCE vulnerability response
  29. 2026-10-23 00:39 UTC PHP emergency patching and RCE vulnerability response
  30. 2026-10-22 13:56 UTC PHP emergency patching and RCE vulnerability response
  31. 2026-10-22 07:20 UTC PHP emergency patching and RCE vulnerability response
  32. 2026-10-22 05:17 UTC PHP emergency patching and RCE vulnerability response
  33. 2026-10-22 05:03 UTC PHP emergency patching and RCE vulnerability response
  34. 2026-10-22 05:01 UTC PHP emergency patching and RCE vulnerability response
  35. 2026-10-22 01:34 UTC PHP emergency patching and RCE vulnerability response
  36. 2026-10-21 23:04 UTC PHP emergency patching and RCE vulnerability response
  37. 2026-10-21 20:28 UTC PHP emergency patching and RCE vulnerability response
  38. 2026-10-21 17:46 UTC PHP emergency patching and RCE vulnerability response
  39. 2026-10-21 17:20 UTC PHP emergency patching and RCE vulnerability response
  40. 2026-10-21 16:06 UTC PHP emergency patching and RCE vulnerability response
  41. 2026-10-21 16:05 UTC PHP emergency patching and RCE vulnerability response
  42. 2026-10-21 14:27 UTC PHP emergency patching and RCE vulnerability response
  43. 2026-10-21 13:13 UTC PHP emergency patching and RCE vulnerability response
  44. 2026-10-21 12:09 UTC Software vulnerability disclosure and PHP patching updates
  45. 2026-10-21 10:27 UTC Software vulnerability disclosure and patching updates
  46. 2026-10-21 09:04 UTC Software vulnerability disclosure and patching updates

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.