PHP developers prepare emergency patches for two critical remote execution flaws
PHP maintainers are issuing patches on October 21 for two critical vulnerabilities dubbed PHP2Shell that enable remote code execution via multipart uploads.
FTMQ Security, written by our newsroom0 views
PHP maintainers are preparing emergency security fixes for two critical remote code execution vulnerabilities on October 21, 2026. According to Pasquale Pillitteri, Cyber Daily, and The Hacker News, the flaws involve multipart upload processing in the PHP scripting language. The bugs carry a severity rating of CVSS 9.2. [1][2][3][4]
SecurityWeek and Cyber Kendra reported that the vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619. SecurityWeek noted that the issues could lead to unauthenticated remote code execution, triggering warnings of potential mass exploitation following an early leak of the details. [5][6]
PHP2Shell affects PHP web scripting deployments across versions 5 through 8. The security flaw allows remote attackers to execute arbitrary code on vulnerable servers. [7]
The official patch release is scheduled for 14:00 UTC on October 21. According to The Hacker News, administrators should apply the updates immediately once official advisory details and fixed versions are confirmed. [1][3]
In short
- PHP is addressing two critical remote code execution vulnerabilities tracked as PHP2Shell.
- The flaws are identified as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2.
- PHP2Shell affects PHP versions 5 through 8 and relates to multipart uploads.
- Official security patches are scheduled for release at 14:00 UTC on October 21, 2026.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]PHP2Shell, PHP RCE flaws and multipart uploads, patch due October 21Pasquale Pillitteri, 3h ago (the report this story comes from)
- [2]Alert! PHP preparing to address pair of critical RCE vulnerabilitiesCyber Daily, 12h ago
- [3]PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertThe Hacker News, 6h ago
- [4]PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertThe Hacker News, 6h ago
- [5]PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak EarlyCyber Kendra, 15h ago
- [6]PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP FlawsSecurityWeek, 4h ago
Background
- [7]PHP2Shell on Wikipedia
- [8]Net neutrality in the United States on Wikipedia
- [9]October on Grokipedia
Our newsroom writes these reports with the help of software, from the 9 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
More in Bugs and Patches
- Chinese state hackers exploited BeyondTrust zero-day flaw for seven weeks1d ago
- Terra Security finds sharp rise in broken software patches during 20261d ago
- CISA orders federal agencies to patch critical Windows Shell vulnerability2d ago
- Critical Nextcloud Collabora app flaw exploited to plant web shells2d ago
- Microsoft patches actively exploited Windows Shell zero day vulnerability5d ago
- Hackers chain Ivanti zero days to gain remote root access6d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.