remote code execution

Page 4 of 4

Monday 26 October 2026

PHP warns admins of two critical flaws, emergency patches due next day

VulnerabilitiesExploitedCVE-2026-109618CVSS 9.22 min read12:23 UTC

The PHP security team said it would ship emergency updates for two vulnerabilities rated 9.2 under CVSS v4.0, after details reportedly leaked ahead of the planned disclosure.

Details of two critical PHP flaws leak ahead of planned patches

VulnerabilitiesExploitedCVE-2026-109618CVSS 9.22 min read12:17 UTC

PHP says fixes for the two critical-severity bugs, publicly dubbed PHP2Shell, are planned for Wednesday, 21 October 2026 at 14:00 UTC, and urges users to prepare to upgrade immediately.