PHP2Shell: Emergency PHP RCE Patches, Leaks, and Early Exploitation (CVE-2026-109618/109619)
In a special edition of Cybersecurity Today, host David Shipley covers emergency PHP patches for two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP 5.4+ and essentially all PHP deployments serving web requests across major stacks.
He explains the shared root cause involving corrupted memory after abnormal request termination, outlines the fixed releases (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35), and notes no official updates for PHP 8.1 and older beyond limited source backports. Mitigations and Cloudflare WAF rules are described as partial, with patching urged by the UK NCSC.
The episode details AI-assisted discovery and coordination via OpenAI's Patch the Planet and tools from Wiz, how leaks on Hacker News accelerated disclosure, and reports of early in-the-wild exploitation attempts, outages, and expectations of rapid exploit development, web shells, and a long tail of downstream patching challenges.
00:00 PHP2Shell Emergency Alert
01:32 What The CVEs Do
02:05 Patches And Mitigations
03:40 AI Discovery And Leak
05:32 Exploit Chatter Spreads
06:46 Early Impact And Outages
08:22 Exposure By The Numbers
09:53 What Happens Next
11:50 Wrap Up And Thanks
Read the original article: