PHP Releases Emergency Fixes for Critical PHP2Shell Vulnerabilities
PHP releases emergency PHP2Shell fixes for two critical flaws allowing unauthenticated code execution. Website owners and hosting providers must update.
PHP developers have released emergency security updates for two critical vulnerabilities that can let attackers run code on web servers without logging in. The fixes arrived on October 21, 2026, a day after maintainers warned administrators to prepare for immediate patching.
Known publicly as PHP2Shell, the flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0. PHP’s official announcement identifies installations serving web requests as at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
Google-owned security company Wiz said its researchers identified both vulnerabilities with help from AI tools. Separately, OpenAI said cybersecurity firm Calif identified a critical PHP flaw using GPT-5.6 Sol through its Patch the Planet initiative. PHP’s maintainers led the fixes and release, with support from the researchers and infrastructure providers.
CompareSecurity
Apache...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
