Skip to the rundown
GetYourBrief Cybersecurity desk · October 21, 2026
Search

Vulnerability · on the rundown Wednesday, October 21, 2026

PHP releases emergency fixes for two PHP2Shell code execution flaws

Covered by 18 outlets over 11 hours. First reported by CyberSecurityNews at 03:34 UTC on October 21, 2026.

18 outlets

What happened?

  1. The PHP security team said the risk is highest for mod_php, citing a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs.
  2. CVE-2026-109619 is a stale global state vulnerability enabling unauthenticated heap use-after-free, memory disclosure and RCE with the web worker's privileges; CVE-2026-109618 reaches RCE as the web worker via an out-of-memory corruption chain.
  3. Fixed releases named by the PHP project are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports provided for PHP 7.4, 8.0 and 8.1.

Every PHP setup that handles web requests is impacted by both, PHP-FPM, Apache using mod_php, php-cgi, FrankenPHP and LiteSpeed included, and patches have been released in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, alongside minimal source-level backports targeting PHP 7.4, 8.0 and 8.1.

A machine summary written from the reports listed below; read them for the full account. How summaries are made and what is checked.

Who reported it, and when?

18 distinct reports run by 18 outlets, earliest first (UTC); a syndicated report lists every site that ran it
TimeReportRun by
Oct 21 03:34Report by CyberSecurityNews
  • CyberSecurityNews
Oct 21 04:29PHP vulnerability puts WordPress, websites at risk after leak - Chron
  • Chron
Oct 21 04:57Report by The Hacker News
  • The Hacker News
Oct 21 06:13Report by The Mandarin
  • The Mandarin
Oct 21 07:46EU cybersecurity agency in warning on PHP vulnerabilities - RTE.ie
  • RTE.ie
Oct 21 08:37Critical PHP Security Flaws Prompt Cyber Agency Warnings and Patches - Global Banking & Finance Review
  • Global Banking & Finance Review
Oct 21 08:42Report by dev.ua
  • dev.ua
Oct 21 08:52Cyber Agency Warns Websites May Go Dark as PHP Prepares Critical Fix - ASHARQ AL-AWSAT English
  • ASHARQ AL-AWSAT English
Oct 21 08:58Report by iTnews
  • iTnews
Oct 21 10:07Report by National Cyber Security Centre
  • National Cyber Security Centre
Oct 21 11:41Report by AppleInsider
  • AppleInsider
Oct 21 11:49A critical PHP vulnerability may take websites down today - The Verge
  • The Verge
Oct 21 12:35Report by BBC
  • BBC
Oct 21 13:11Report by The Brussels Times
  • The Brussels Times
Oct 21 13:25Critical PHP Vulnerability Affects 70% of Websites Worldwide; Patch to Be Released Tonight - BigGo Finance
  • BigGo Finance
Oct 21 13:44Report by CyberScoop
  • CyberScoop
Oct 21 13:48Report by Global News
  • Global News
Oct 21 14:07Report by bleepingcomputer.com
  • bleepingcomputer.com

A report's title is shown once our automated legal check has read it and passed it; 12 reports are named by outlet, and the links lead to each report.

Who was named?

  • PHP
  • PHP2Shell
  • CVE-2026-109619
  • CVE-2026-109618
  • php-cgi
  • PHP security team
  • PHP-FPM
  • LiteSpeed
  • FrankenPHP

More news naming PHP

  1. Oct 21 · Cyber Ars Technica: “PHP warns it plans to release 2 emergency patches imminently” 2

Sources: the outlets' reports linked on this page; counts and times from GetYourBrief's record of those reports (methodology).