The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
Two critical PHP flaws put the web on alert as emergency patches arrive
- Published
- Record updated
Summary
The PHP Foundation released patches for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on CVSS, that could allow unauthenticated remote code execution. The flaws, collectively dubbed PHP2Shell, affect all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk on mod_php. Some government websites in Europe went offline as a precaution.
Mitigation
Affected organizations should update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux and LTS vendors received patches in advance, so organizations should check with their vendors. Users of rpms.remirepo.net should switch distribution packages or build from source. Those unable to patch immediately should take the preventive action described by the PHP Foundation, though CERT-EU warns these mitigations do not make an installation safe.