Story perspectives

U.S. PHP Foundation Patches PHP2Shell Remote Code Flaws

By Drooid · Oct 24, 2026, 10:30 PM UTC · How we work

Summary

Story summary

The U.S. PHP Foundation released patches for PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Wednesday.
Calif researchers discovered the bugs and demonstrated unauthenticated remote code execution.
The flaws could let attackers gain full control of any unpatched web-facing server.
Cloudflare recorded millions of exploitation attempts within hours of the public disclosure.
Amazon detected early PHP2Shell exploitation on October 17, before patches were available.

1 of 1

Story summary

The U.S. PHP Foundation released patches for PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Wednesday.
Calif researchers discovered the bugs and demonstrated unauthenticated remote code execution.
The flaws could let attackers gain full control of any unpatched web-facing server.
Cloudflare recorded millions of exploitation attempts within hours of the public disclosure.
Amazon detected early PHP2Shell exploitation on October 17, before patches were available.