Story perspectives

PHP Foundation Releases Emergency Patches for CVE-2026-109618, 109619

By Drooid · Oct 22, 2026, 2:34 PM UTC · How we work

Summary

Story summary

The PHP Foundation (US) released emergency patches for CVE-2026-109618 and CVE-2026-109619.
The “php2shell” flaws earned a CVSS v4.0 severity rating of 9.2.
They allow unauthenticated remote code execution on all PHP versions from 5, affecting 70-75% of servers.
Japan, the Netherlands, Finland, France, Australia, the US, NSA and CISA urged immediate patching or isolation.
OpenAI and Google AI models helped discover the flaws, creating a defender’s window before disclosure.

1 of 1

Story summary

The PHP Foundation (US) released emergency patches for CVE-2026-109618 and CVE-2026-109619.
The “php2shell” flaws earned a CVSS v4.0 severity rating of 9.2.
They allow unauthenticated remote code execution on all PHP versions from 5, affecting 70-75% of servers.
Japan, the Netherlands, Finland, France, Australia, the US, NSA and CISA urged immediate patching or isolation.
OpenAI and Google AI models helped discover the flaws, creating a defender’s window before disclosure.