Story thread

PHP critical vulnerability patches

PHP developers are issuing emergency updates for two critical vulnerabilities that researchers say could enable remote code execution and widespread site outages.

46 stories from 17 sources · since Oct 20

Clio’s read on this thread

PHP maintainers and security observers say two critical unauthenticated RCE flaws in PHP core have been patched, or were about to be, while exploitation and scanning began almost immediately. The risk spans a huge share of internet-facing apps, including CMS, e-commerce, and shared hosting. CIOs should treat this as an emergency inventory-and-patch event, with possible downtime and compensating controls needed during remediation.

Key points

  • Two core PHP flaws enable unauthenticated remote code execution and sensitive memory disclosure.
  • Severity is reported as CVSS 9.2 to 9.4, with broad exposure across internet-facing PHP deployments.
  • Exploitation moved quickly from probes to active attacks; some activity appeared before public disclosure.
  • Cloudflare, AWS, and others reported mitigations, attack attempts, and large-scale scanning.
  • Older PHP versions may depend on third-party backports, complicating remediation.

Where coverage agrees

  • The flaws are critical PHP core issues that can lead to unauthenticated remote code execution on internet-facing systems.Ars Technica · SANS Internet Storm Center · Hacker News · TechMeme · The Register · SecurityWeek · Dark Reading · CSO Online
  • Attack activity began quickly, with probes or exploitation attempts appearing around disclosure and in some cases before it.SecurityWeek · The Register · SANS Internet Storm Center · Schneier on Security · Cloudflare Blog · Krebs on Security
  • CIOs should prioritize rapid patching, asset visibility, and compensating controls such as WAFs or temporary hardening.Ars Technica · SANS Internet Storm Center · Cloudflare Blog · CSO Online · SecurityWeek · The Verge

Where sources differ

  • Ars Technica and CSO Online describe the flaws as CVSS 9.2, while SANS Internet Storm Center rates them CVSS 9.4.Ars Technica · CSO Online · SANS Internet Storm Center
  1. UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contestThe Register · Oct 26 · Clio 69
  2. PHP2Shell Exploitation Moves From Probes to Working ShellsSecurityWeek · Oct 26 · Clio 84
  3. We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glueThe Register · Oct 26 · Clio 67
  4. PHP2Shell: No login, no app code, no warning. What next?The Register · Oct 26 · Clio 83
  5. PHP-ocalypse: How two critical web bugs almost broke the internetTechCrunch · Oct 24 · Clio 73
  6. (Reliable)? php2shell exploitability, (Fri, Oct 23rd)SANS Internet Storm Center · Oct 23 · Clio 65
  7. There's a third PHP2Shell bug, but it won't get an emergency fixThe Register · Oct 23 · Clio 66
  8. Exposed to PHP2Shell? Cyber Experts Weigh in With AdviceDark Reading · Oct 23 · Clio 76
  9. PHP2Shell was only the beginning: AI is accelerating the patch raceThe New Stack · Oct 23 · Clio 73
  10. What to do as critical PHP flaws puts millions of websites at riskNewsletters · Oct 23 · Clio 77
  11. PHP2Shell exposes the weakness in coordinated vulnerability disclosureCSO Online · Oct 23 · Clio 78
  12. PHP2Shell exploit bypasses protections designed to stop remote code executionThe Register · Oct 22 · Clio 75
  13. The disastrous PHP vulnerabilities were exploited days before the patchThe Verge · Oct 22 · Clio 72
  14. Hackers got a four-day head start on epic PHP2Shell vulnerabilityArs Technica · Oct 22 · Clio 75
  15. Cloudflare's Matthew Prince says PHP2Shell exploit attempts on its network rose from thousands in the 10 hours before the disclosure to millions afterward (Matthew Prince/@eastdakota)TechMeme · Oct 22 · Clio 75
  16. PHP: The three little letters wreaking havoc across the webThe Verge · Oct 22 · Clio 78
  17. AI found a critical PHP flaw. The bigger failure began in 2024.The New Stack · Oct 22 · Clio 70
  18. PHP’s security scramble is just a preview: AI is digging up flaws faster than maintainers can fix themThe New Stack · Oct 22 · Clio 74
  19. New Serious PHP Vulnerabilities Released and PatchedSchneier on Security · Oct 22 · Clio 85
  20. Tech and Security Companies Respond to PHP2Shell VulnerabilitiesSecurityWeek · Oct 22 · Clio 69
  21. Hackers pile on PHP2Shell as AWS reveals attacks began before disclosureThe Register · Oct 22 · Clio 78
  22. PHP2Shell Exploitation Started Days Before PatchesSecurityWeek · Oct 22 · Clio 79
  23. AWS analysts claim that at least one actor started to exploit the PHP2Shell bugs on October 17, four days prior to the vulnerabilities' public disclosure (Lily Hay Newman/Wired)TechMeme · Oct 22 · Clio 76
  24. Hackers Exploited the PHP Vulnerabilities Days Before They Were PatchedWired · Oct 22 · Clio 73
  25. PHP blames supply chain security biz Chainguard for putting huge chunks of the web at riskThe Register · Oct 21 · Clio 67
  26. AI found flaws in the code behind 70% of the web. The fix took two months.The New Stack · Oct 21 · Clio 78
  27. Two critical PHP flaws put the web on alert as emergency patches arriveCSO Online · Oct 21 · Clio 81
  28. PHP: The three letters that shut down sites all over the internet todayThe Verge · Oct 21 · Clio 80
  29. 'PHP2Shell' Bugs Signal Red Alert for Security IndustryDark Reading · Oct 21 · Clio 84
  30. Today's PHP Security Release, and How We're Strengthening PHP SecuritySimon Willison's Weblog · Oct 21 · Clio 81
  31. The PHP Foundation says its patches for the RCE vulnerabilities are limited to PHP 8.2 and newer, leaving legacy deployments dependent on third-party vendors (Wired)TechMeme · Oct 21 · Clio 81
  32. PHP2Shell Patches Land as First Exploitation Attempts Hit SensorsSecurityWeek · Oct 21 · Clio 81
  33. The PHP Foundation details how it found and fixed the two flaws, and says it had to release patches a day early after the CVE IDs began circulating online (The PHP Foundation)TechMeme · Oct 21 · Clio 63
  34. Widespread PHP Flaw May Cause Many Site Outages TodayKrebs on Security · Oct 21 · Clio 79
  35. PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatchedThe Register · Oct 21 · Clio 87
  36. ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on FireWired · Oct 21 · Clio 78
  37. Cloudflare says it deployed WAF mitigations for all free and paid tier customers to combat two PHP flaws by default, about nine hours ahead of public disclosure (Cloudflare)TechMeme · Oct 21 · Clio 70
  38. PHP's creators disclose a critical memory-management vulnerability, dubbed "PHP2Shell", that affects up to 70% of websites, discovered via GPT-5.6 Sol in August (Robert McMillan/Wall Street Journal)TechMeme · Oct 21 · Clio 69
  39. PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update (PHP)TechMeme · Oct 21 · Clio 86
  40. Cloudflare deploys protections against php2shell vulnerabilityCloudflare Blog · Oct 21 · Clio 80
  41. PHP2Shell: AI uncovers critical RCE in PHPHacker News · Oct 21 · Clio 79
  42. Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)SANS Internet Storm Center · Oct 21 · Clio 79
  43. A critical PHP vulnerability may take websites down todayThe Verge · Oct 21 · Clio 75
  44. An unconfirmed report claims PHP2Shell enables RCE on PHP sites; watchTowr says the exploit allegedly affects all versions since PHP 5, released in 2004 (Dan Goodin/Ars Technica)TechMeme · Oct 21 · Clio 75
  45. PHP warns it plans to release 2 emergency patches imminentlyArs Technica · Oct 21 · Clio 79
  46. PHP development team plans to release updates tomorrow to address two vulnerabilities, each rated 9.2; security researchers at watchTowr say they are RCE flaws (Lawrence Abrams/BleepingComputer)TechMeme · Oct 20 · Clio 75