PHP Ships Emergency Patches for Two Critical 'php2shell' Flaws as Early Attacks Emerge

The PHP project has released emergency security updates for two vulnerabilities it rates as critical, tracked as CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10 on the CVSS v4.0 severity scale. Researchers describe them as remote code execution flaws, which could let an attacker run their own code on a server and potentially take control of it. The issues have been nicknamed "php2shell". Fixes are available in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, covering the supported branches 8.2 through 8.5.

The release was brought forward after details of the flaws leaked online. Security firm watchTowr said the fixes had originally been planned for Thursday under embargo. A video demonstrating an exploit chain circulated overnight, and watchTowr said it had reproduced one of the flaws. Cloudflare's chief technology officer, Dane Knecht, said the company was seeing early attacks and had deployed firewall rules for all customers, including free accounts, though he called this a stopgap.

At the time of the original report, the technical cause and a full list of affected versions had not been officially confirmed. An advisory from CERT-EU says the flaws could affect every PHP version from 5 onward. Code claiming to exploit the flaws is also circulating online but has not been verified, and security firms warn that such code is sometimes laced with malware, so defenders should avoid running it.