PHP Patches 2 Critical PHP2Shell RCEs Affecting Versions Back to 5.4
Updated
Updated · O'Reilly Media · Oct 28
PHP Patches 2 Critical PHP2Shell RCEs Affecting Versions Back to 5.4
3 articles · Updated · O'Reilly Media · Oct 28
Summary
PHP released fixes on Oct. 21 for two remote-code-execution flaws—CVE-2026-109618 and CVE-2026-109619—and urged all deployments to move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Wiz Research found the bugs in late August and said the exploit chain reaches back to PHP 5.4, leaving a long tail of legacy WordPress, Drupal and other PHP-based sites exposed if they cannot upgrade.
Amazon apparently detected exploitation in the wild on Oct. 17, before details leaked on Oct. 20, underscoring how quickly attackers may have weaponized the flaws.
Wiz said frontier models including Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol helped uncover a complex chain of long-standing bugs, suggesting AI is shrinking the gap between vulnerability discovery and real-world exploitation.
The episode points beyond PHP to a broader risk for undermaintained open-source software, where small security teams may struggle to validate reports, build fixes and keep aging internet infrastructure patched.