Story perspectives

NSA Warns to Patch Critical PHP2Shell Flaws After Exploits

By Drooid · Oct 23, 2026, 2:39 PM UTC · How we work

Summary

Story summary

The NSA warned organizations to patch critical PHP2Shell flaws on October 21, 2026.
Researchers showed unauthenticated remote code execution on Apache and PHP-FPM servers using CVE-2026-109618 and CVE-2026-109619.
Amazon Threat Intelligence recorded exploit attempts on October 17, 2026, four days before the vulnerabilities were disclosed.
Cloudflare observed scanning attempts surge from tens of thousands to millions within 45 minutes of the October 21 disclosure.

History

Historical Context

In 2012 a buffer-over-read was silently added to OpenSSL; its public disclosure on 7 April 2014 (Heartbleed) exposed roughly 17 % of TLS-enabled sites, prompting massive patch campaigns by Google, the EFF and U.S. agencies. The episode spurred automated patch management, a practice now invoked as the NSA warns of PHP2Shell flaws and similar weaponized out-of-bounds reads.

1 of 2

Story summary

The NSA warned organizations to patch critical PHP2Shell flaws on October 21, 2026.
Researchers showed unauthenticated remote code execution on Apache and PHP-FPM servers using CVE-2026-109618 and CVE-2026-109619.
Amazon Threat Intelligence recorded exploit attempts on October 17, 2026, four days before the vulnerabilities were disclosed.
Cloudflare observed scanning attempts surge from tens of thousands to millions within 45 minutes of the October 21 disclosure.

1 / 2