Two unauthenticated remote code execution bugs in PHP core affect every install serving web requests (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed), with mod_php the highest risk. Fixes landed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 plus source backports for 7.4 to 8.1. Found by Calif, OpenAI (using GPT-5.6 Sol) and Wiz; Cloudflare saw attacks before the patches shipped and VirusTotal counts over 5 million exposed hosts.
What to do: Fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; 8.1 and older need vendor backports or upgrade; OpenAI published a checker (github.com/openai/php2shell-checker). Oct 24 13:21 UTC: CISA updated its PHP2Shell alert with a SIGMA rule and says to take PHP 8.1 or earlier, or anything that cannot be patched, offline until updated. NSA guidance (Oct 23) is backed by CISA, UK NCSC, ASD and CERT-EU per NSA's……
AI angle: OpenAI says its Patch the Planet program found the bugs with GPT-5.6 Sol about two months earlier; the PHP Foundation also scanned with Claude Mythos.
but also, don't panic. @UK_Daniel_Card has a good point: successfully exploited in the wild, *against a honeypot.
⚠️ Une mise à jour de PHP a été publiée. Elle corrige deux vulnérabilités critiques dont l’exploitation rapide est à craindre. Plus d'informations sur les vulnérabilités, les versions affectées et les recommandations à
❗ ALERT ❗ We are aware of media reporting about critical vulnerabilities in PHP that may affect all versions from PHP 5 onwards. Organisations and individuals should monitor PHP applications and prepare to update and app
🚨 Krytyczne podatności w PHP umożliwiające zdalne wykonanie kodu 🚨 Luki oznaczone identyfikatorami CVE-2026-109618 oraz CVE-2026-109619 pozwalają atakującemu na zdalne wykonanie dowolnych poleceń systemowych. ‼️ Podatn
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent
Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative.
Why this score
Internet-wide exposure (impact 4), millions of exploitation attempts within days (exploitability 3), government and critical sites knocked offline (criticality 2).
time of earliest verified post