Upozornění na "php2shell", dvě kritické zranitelnosti v PHP

CVE v události 2

Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 9.8.

Jak se o tom psalo 42

1. 23. 10. 2026 00:04 · Tenable Research US

   The adversary economy: How threat actors are reacting to PHP2Shell

   Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. Key takeaways The adversary economy operates on the same fundamental principles as the legitimate economy. Forum self-evacuations: Criminal forums including BreachForums initiated emergency infrastructure migrations, taking themselves offline within hours of PHP2Shell disclosure,…

2. 22. 10. 2026 20:04 · Cisco Talos US

   I had plans for that second

   Welcome to this week’s edition of the Threat Source newsletter. Here for the latest on the PHP vulnerabilities? Head on down to ‘The One Big Thing’. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset. But if you want a bit of levity, here’s what I wrote before everything kicked off yesterday: Ever feel like the world is moving too fast to keep up? Well, I bring you scientific proof that it’s not just you.…

3. 22. 10. 2026 15:09 · BleepingComputer US

   Amazon says PHP2Shell exploitation began 4 days before patches

   Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...]

4. 22. 10. 2026 10:00 · CSIRT.CZ – novinky CZ

   Kritické zranitelnosti PHP umožňují vzdálené spuštění kódu

   Vývojový tým PHP zveřejnil bezpečnostní aktualizace, které opravují dvě kritické zranitelnosti v jádře jazyka PHP. Zranitelnosti CVE-2026-109618 a CVE-2026-109619 mohou za určitých podmínek umožnit neautentizovanému útočníkovi vzdálené spuštění libovolného kódu na zranitelném serveru. Problém se týká širokého spektra instalací PHP, které zpracovávají webové požadavky, včetně konfigurací PHP-FPM, Apache s modulem mod_php a dalších způsobů nasazení. Provozovatelům dotčených systémů doporučujeme…

5. 22. 10. 2026 · zachyceno 04:00 · NCSC-FI FI

   Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products

   Classification: Critical, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.2, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out…

6. 22. 10. 2026 · zachyceno 04:00 · NCSC-FI FI

   PHP Security advisory: Critical remote code execution vulnerabilities

   Classification: Critical, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.2, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest…

7. 22. 10. 2026 · zachyceno 21:30 · Splunk Advisories US

   SVD-2026-1013: Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026

   Splunk is investigating to determine which products may be affected by these vulnerabilities and the impact on each affected product. Currently, no products are known to be affected. This advisory will be updated as information is available.

8. 21. 10. 2026 21:12 · Cisco PSIRT US

   Vulnerabilities in PHP Affecting Cisco Products: October 2026

   On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content…

9. 21. 10. 2026 19:30 · Cyber Centre Kanada CA

   AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619

   Number: AL26-026 Date: October 21, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Canadian…

10. 21. 10. 2026 18:14 · Malwarebytes Labs US

    PHP2Shell: Why websites are going offline for emergency security updates

    If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched. The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10. Why this matters PHP is a programming language that works behind the…

11. 21. 10. 2026 18:00 · Palo Alto PSIRT US

    CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)

12. 21. 10. 2026 17:18 · Securelist (Kaspersky) RU

    Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

    Vulnerability overview On October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities (both rated 9.2 on the CVSS scale). The patches were released on Wednesday, October 21, 2026, at 14:00 UTC. The release was expedited after information about the vulnerabilities was leaked to the public before the scheduled embargo was lifted. In a post on Hacker News, a user reported two RCE vulnerabilities in PHP,…

13. 21. 10. 2026 17:10 · Cisco Talos US

    Two critical RCEs in PHP core

    Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial intelligence and associated technologies played a key role in the discovery of these vulnerabilities — yet another example of how these technologies are forcing change across the landscape…

14. 21. 10. 2026 17:03 · NÚKIB CZ nadpis události

    Upozornění na "php2shell", dvě kritické zranitelnosti v PHP

    Upozorňujeme na dvojici zranitelností v PHP, označovaných jako "php2shell" (CVE-2026-109618 a CVE-2026-109619), které mohou vést ke vzdálenému spuštění kódu (RCE) bez nutnosti přihlášení. Zranitelnosti CVE-2026-109618: Při zpracování chyb způsobených nedostatkem paměti (OOM) prostřednictvím funkce longjmp() dochází kvůli nesprávnému řízení toku programu k ponechání paměti požadavku v neinicializovaném stavu. Útočník může cíleným vyvoláním stavu nedostatku paměti tuto nekonzistenci spolehlivě…

15. 21. 10. 2026 16:21 · CSIRT Itálie (ACN) IT

    PHP2Shell: sanate vulnerabilità critiche in PHP

    Aggiornamenti di sicurezza sanano 2 nuove vulnerabilità con gravità "critica" in PHP, noto interprete del linguaggio di scripting per lo sviluppo web. Tali vulnerabilità interessano la componente php-src e, qualora sfruttate, potrebbero permettere a un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi interessati.

16. 21. 10. 2026 16:21 · CSIRT Itálie (ACN) IT

    PHP2Shell: sanate vulnerabilità critiche PHP

    Aggiornamenti di sicurezza sanano 2 nuove vulnerabilità con gravità "critica" in PHP, noto interprete del linguaggio di scripting per lo sviluppo web. Tali vulnerabilità interessano la componente php-src e, qualora sfruttate, potrebbero permettere a un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi interessati.

17. 21. 10. 2026 16:21 · CSIRT Itálie (ACN) IT

    PHP: sanate vulnerabilità critiche

    Aggiornamenti di sicurezza sanano 2 nuove vulnerabilità con gravità "critica" in PHP, noto interprete del linguaggio di scripting per lo sviluppo web. Tali vulnerabilità interessano la componente php-src e, qualora sfruttate, potrebbero permettere a un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi interessati.

18. 21. 10. 2026 16:07 · BleepingComputer US

    PHP ships emergency patches for critical PHP2Shell flaws

    The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]

19. 21. 10. 2026 16:01 · NCSC-NL NL

    NCSC-2026-0443 [1.00] [H/H] Kwetsbaarheden verholpen in PHP

    PHP heeft twee kritieke kwetsbaarheden verholpen. De kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt voor het uitvoeren van willekeurige code. Alle PHP-installaties die webverzoeken verwerken zijn getroffen. De kwetsbaarheid met kenmerk CVE-2026-109618 betreft geheugenbeschadiging bij de afhandeling van een Out-of-Memory-situatie. Hierdoor kunnen interne requestgegevens slechts gedeeltelijk worden geïnitialiseerd en tijdens de verwerking als geldige gegevens worden…

20. 21. 10. 2026 15:49 · CERT.at AT

    Kritische Sicherheitslücken in PHP - Updates verfügbar

    21. Oktober 2026 Beschreibung In PHP existieren zwei kritische Sicherheitslücken, deren Ausnutzung es nicht authentifizierten Angreifer:innen ermöglichen kann, aus der Ferne beliebigen Code auszuführen. Betroffen sind laut PHP-Projekt alle PHP-Installationen, die Web-Anfragen verarbeiten, darunter PHP-FPM, Apache mit mod_php, php-cgi, FrankenPHP und LiteSpeed. Bei CVE-2026-109618 kann die Behandlung von Out-of-Memory-Zuständen (OOM) PHP unterbrechen, während interne Anfragedaten nur teilweise…

21. 21. 10. 2026 15:40 · Palo Alto Unit 42 US

    Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

    CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 appeared first on Unit 42.

22. 21. 10. 2026 15:27 · Cyber Centre Kanada CA

    PHP security advisory (AV26-1070)

    Serial Number: AV26-1070 Date: October 21, 2026 PHP security advisory (AV26-1070) As of October 21, 2026, PHP is affected by vulnerabilities in the following product: PHP Versions prior to 8.x The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Upcoming Critical PHP Security Release PHP Security Releases

23. 21. 10. 2026 14:44 · SANS Internet Storm Ctr. US

    Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)

    PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead of the patch becoming available. This diary will be continuously updated today. I am starting to write this diary with many details still unclear and with the patch not yet available. Which versions of PHP are vulnerable? The easy answer: All of them. At least…

24. 21. 10. 2026 14:21 · DNSC Rumunsko RO

    ALERTĂ: Vulnerabilități critice în PHP

    DESCRIERE În data de 20 octombrie 2026, echipa de securitate PHP a anunțat publicarea unei a...

25. 21. 10. 2026 · zachyceno 18:00 · CISA Advisories US

    Critical Vulnerabilities in PHP Require Immediate Patching

    CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of…

26. 21. 10. 2026 14:00 · CERT-SE SE

    Kritiska sårbarheter i PHP

    PHP kommer vid klockan 16:00 svensk tid att publicera säkerhetsuppdateringar för två kritiska sårbarheter, CVE-2026-109618 och CVE-2026-109619. Sårbarheterna har fått en CVSS-klassning på 9.2 och kan utnyttjas för oautentiserad exekvering av skadlig kod. [1]

27. 21. 10. 2026 · zachyceno 12:00 · NCSC UK GB

    Critical security issue affecting PHP

    The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP.

28. 21. 10. 2026 12:00 · CERT.hr HR

    UPOZORENJE: Kritične ranjivosti u PHP-u – čeka se nadogradnja

    PHP Security Team najavio je izvanrednu sigurnosnu zakrpu zakazanu za 21. listopad 2026. u 16:00 sati (14:00 UTC). Pozivaju sve PHP korisnike na hitnu primjenu zakrpi. Prije službene objave procurile su informacije o dvjema kritičnim ranjivostima u jezgri PHP-a koje napadaču putem web zahtjeva omogućuju preuzimanje poslužitelja. Uspješno iskorištavanje ranjivosti napadaču omogućava izvršavanje proizvoljnog programskog koda (engl. remote code execution – RCE) bez autentifikacije. Radi se o…

29. 21. 10. 2026 11:01 · Tenable Research US

    php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

    Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing…

30. 21. 10. 2026 10:09 · SK-CERT (NBÚ SR) SK

    Národné centrum kybernetickej bezpečnosti SK-CERT varuje pred dvoma kritickými zraniteľnosťami v PHP, identifikovanými a

    Národné centrum kybernetickej bezpečnosti SK-CERT varuje pred dvoma kritickými zraniteľnosťami v PHP, identifikovanými ako CVE-2026-109618 a CVE-2026-109619. Podľa aktuálne dostupných informácií môže úspešné zneužitie umožniť vzdialenému neautentifikovanému útočníkovi vykonať ľubovoľný kód na zasiahnutom systéme. Obe zraniteľnosti majú pridelené skóre CVSS v4.0 vo výške 9,2. Zraniteľnosti sú zneužiteľné vo všetkých verziách od PHP 5.0 až po... The post appeared first on SK-CERT.

31. 21. 10. 2026 09:09 · NKI Maďarsko HU

    Riasztás a PHP futtatókörnyezet kritikus sérülékenységeiről

    A Nemzetbiztonsági Szakszolgálat Nemzeti Kiberbiztonsági Intézet (NBSZ NKI) riasztást ad ki a PHP futtatókörnyezetet érintő két kritikus sérülékenységgel kapcsolatban, tekintettel azok súlyosságára, várható kihasználására, valamint az érintett technológia széles körű elterjedtségére. A PHP fejlesztői 2026. október 21-én 14:00 UTC-kor (magyar idő szerint 16:00 órakor) tervezik közzétenni a két sérülékenységet javító biztonsági frissítéseket. A CVE-2026-109618 és […]

32. 21. 10. 2026 · zachyceno 21:30 · Fortinet PSIRT US

    PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)

    CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Revised on 2026-10-21 00:00:00

33. 21. 10. 2026 · zachyceno 18:30 · CrowdStrike US

    CrowdStrike Protects Customers from Threats Delivered via PHP2Shell

34. 21. 10. 2026 06:00 · Huntress US

    Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

    Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.

35. 21. 10. 2026 04:59 · Qualys US

    PHP Announces Critical Security Release for Two Vulnerabilities

    On October 20, 2026, the PHP security team announced an upcoming security release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. The release is scheduled for October 21, 2026, at 14:00 UTC. PHP has indicated that the updates may be released earlier if vulnerability details become public or evidence of active exploitation emerges. Public reports have linked CVE-2026-109618 and CVE-2026-109619 to the upcoming PHP security release. However, PHP has not yet confirmed these…

36. 21. 10. 2026 03:54 · Aikido Security BE

    What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

    Two critical PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) are being patched. Every PHP version is affected. How to patch, a temporary mitigation, and how to check your hosts. Category: Vulnerabilities & Threats

37. 21. 10. 2026 · zachyceno 17:30 · Elastic Security US

    php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619

    On October 20, 2026, details of two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online ahead of their coordinated disclosure and before any patch existed. The PHP security team responded with advance notice of an emergency security release, scheduled for October 21, 2026 at 14:00 UTC, and rated both flaws critical with a CVSS v4.0 score of 9.2. Researchers at watchTowr confirmed the vulnerabilities are real and said they reproduced CVE-2026…

38. 21. 10. 2026 · zachyceno 17:00 · CERT-FR – avis FR

    Multiples vulnérabilités dans PHP (21 octobre 2026)

    De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.

39. 21. 10. 2026 · zachyceno 15:01 · Sophos Threat Research GB

    Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

    Categories: Threat Research Tags: advisory, vulnerability, php

40. 21. 10. 2026 · zachyceno 13:00 · CERT-FR – alerty FR

    Multiples vulnérabilités dans PHP (21 octobre 2026)

    Le 20 octobre 2026, PHP a publié une communication concernant deux vulnérabilités critiques. L'éditeur annonce la disponibilité des correctifs de sécurité pour le 21 octobre 2026 à 16h00 heure de Paris (14h00 UTC). Pour les versions de PHP 5.x, 6.x, 7.x, 8.0.x et 8.1.x , dont l'éditeur n'assure...

41. 20. 10. 2026 22:56 · BleepingComputer US

    PHP warns admins of two critical flaws, emergency patches coming tomorrow

    The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]

42. 20. 10. 2026 22:33 · CERT-EU EU

    2026-018: Critical Vulnerabilities in PHP

    On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks. At this time, no technical details have been made public. CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available. The…