{ "site": "php.oct.2026.newsroom.sgit.ai", "short": "PHP October 2026", "title": "PHP in October 2026: two critical security flaws, tracked as evidence", "description": "PHP news for October 2026, led by the month's big story: two critical security flaws in PHP (CVE-2026-109618 and CVE-2026-109619, nicknamed php2shell). The current situation in plain words, the core facts with their evidence, what to do, and a briefing for every kind of reader.", "status": "Developing", "data_as_of": "2026-10-22T08:48Z", "data_as_of_note": "the time of the latest capture in the evidence vault; the site is rebuilt from the vault, so this moves only when the vault does", "cves": [ "CVE-2026-109618", "CVE-2026-109619" ], "lead_html": "On 21 October 2026 at 14:00 UTC the PHP project released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed php2shell. Either can give an unauthenticated attacker remote code execution on a web server running PHP, the language behind WordPress, Drupal, Wikipedia and a large share of the web. The flaws were found with AI help, the coordinated disclosure broke down two days early, and by the morning of 22 October the NSA, CISA and the UK's NCSC were telling organisations that could not patch to take systems offline. This site follows the story as evidence: every claim points to a captured, dated and hashed source, every number says what it measures, and every contradiction between sources is left visible.", "caveat_html": "Developing, and agent-produced. Software agents assemble this site from sources captured into a private evidence vault; the editor is Dinis Cruz. Nothing here is advice on what to patch in your environment. For that, read the php.net advisory and your national cyber-security agency. Where this site says a thing is confirmed, it means two or more primary sources agree, or the fact was counted from a captured file; reported means one party says so; disputed means the sources disagree; unverified means even the reporting outlet could not check it.", "known": [ { "html": "There are two flaws, both in the PHP engine, both rated CVSS v4.0 9.2, both fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The CVE records, the GitHub advisories and the php.net advisory agree on this.", "sources": [ "cve-cve-2026-109618", "cve-cve-2026-109619", "github-ghsa-w8hw-w9fx-j79w", "github-ghsa-6wmf-4rv5-p3rp", "php-net-advisory" ] }, { "html": "Unauthenticated remote code execution was demonstrated against Apache with mod_php before any application code runs. PHP-FPM is susceptible; the two primary accounts differ on whether a complete FPM exploit exists.", "sources": [ "github-ghsa-w8hw-w9fx-j79w", "openwall-oss-security-2026-10-21-6", "php-foundation-blog-security-release" ] }, { "html": "The flaws are old. The out-of-memory problem behind CVE-2026-109618 was first seen during a 2024 audit (Quarkslab, funded through OSTIF) and left unfixed because nobody could prove exploitation. PHP 8.1 and older are out of support; the project published minimal source backports for 7.4, 8.0 and 8.1, but the CVE records list only 8.2 to 8.5.", "sources": [ "php-foundation-blog-security-release", "calif-php2shell", "github-php-src-branch-7.4-backport", "cve-cve-2026-109618" ] }, { "html": "Discovery was AI-assisted and three parties claim it. Calif reported first (hash on 5 August, report on 11 August); OpenAI reported the same root cause the same day; Wiz found it independently on 19 August and reported on 24 August. The GitHub advisories credit four reporters.", "sources": [ "calif-php2shell", "x-lcfr-hax-hash-tweet", "php-foundation-blog-security-release", "wiz-blog-php2shell", "github-ghsa-w8hw-w9fx-j79w" ] }, { "html": "Disclosure broke down on 20 October around 15:00 UTC, when the CVE IDs circulated with a wrong CVSS of 10.0. The release moved forward a day; Calif published, then deleted, a demonstration video; Chainguard shipped patched images six hours before the embargo lifted.", "sources": [ "php-foundation-blog-security-release", "daubois-blog-php2shell-rumors", "phpfoundation-blog-security-release-leak" ] }, { "html": "The scale figures do not measure the same thing. 70% of the Internet is a Wiz headline; the body of the same post, Cloudflare and OpenAI say 70% of websites; VulnCheck counts 2.6 million internet-facing hosts; Alan Woodward said something like 30 million websites; Latvia counted about 6,000 potentially affected resources in one country.", "sources": [ "wiz-blog-php2shell", "x-wiz-io-php2shell", "cloudflare-blog-php2shell-waf", "x-openai-php2shell", "thehackernews-php2shell-4days", "bbc-live-ckgel5xp2xv9t", "certlv-php-preventive" ] }, { "html": "Exploitation attempts are reported from several directions, in millions by Cloudflare's count, but no organisation has said it was compromised through php2shell, as of the evidence vault's latest capture (14:42 UTC on 26 October). Amazon says a honeypot was hit on 17 October, four days before disclosure. Sophos withdrew an earlier claim of a successful compromise; its data showed scanning and a few failed attempts. Four named cases have been tested: Valtec retracted, and ČVUT, GMO and DMM state no php2shell cause. Neither CVE is in CISA's Known Exploited Vulnerabilities catalog at the source watch's last check (08:03 UTC on 23 October). The US, Australia, Germany, Switzerland and Japan say they know of no successful exploitation; New Zealand's NCSC alone says it is aware of reports of active exploitation.", "sources": [ "x-eastdakota-php2shell-stats", "aws-security-blog-madpot", "impress-watch-valtec", "lupa-cvut-cyber-attack", "yahoo-jp-gmo-fx-login-leak", "sankei-dmm-service-halt", "cisa-kev-json", "cisa-alert-php-20261021", "acsc-alert-php", "ncsc-nz-alert-php", "cybersecuritynews-critical-php2shell-exploit-code" ] }, { "html": "The advice is turning from patching to looking for break-ins. Singapore's Cyber Security Agency tells organisations to patch internet-facing systems first and to check whether they were already compromised; Luxembourg's authorities ask operators to search back for traces and keep the evidence. The first national count of what is left after the fix is Swiss: just over 23,000 of nearly 690,000 servers, about 3.5%, still affected on 22 October (Risikomonitor, via ICTjournal).", "sources": [ "channelnewsasia-singapore-php-vulnerabilities-csa-singapore-firms-cybersecur", "paperjam-article-php2shell-des-milliers-de-sites", "ictjournal-news-2026-10-22-deux-failles-critiques-d" ] }, { "html": "The agencies do not agree on taking systems offline. The NSA and CISA say take them offline if you cannot patch; the UK NCSC puts that fourth, after patching and temporary mitigations; CERT-EU, Canada and France say isolate; Australia, the Netherlands, Italy, Japan and New Zealand give no offline advice at all.", "sources": [ "nsa-x-2112903220209098897", "cisa-alert-php-20261021", "ncsc-news-php", "certeu-sa-2026-018", "cccs-al26-026", "certfr-2026-ale-014", "acsc-alert-php", "ncsc-nl-php2shell", "acn-it-php2shell", "jpcert-at260033", "ncsc-nz-alert-php" ] } ], "open": [ { "html": "Who first leaked the CVE IDs on 20 October, and where. The PHP Foundation does not say; a PHP security team member points to an anonymous Hacker News post, and Notebookcheck and Nguoi Quan Sat repeat that account. No copy of the post is in the vault." }, { "html": "Whether the deleted Calif video is the one now embedded on Calif's own write-up. Calif's page does not mention the leak." }, { "html": "Whether any site was actually compromised before it was patched or taken offline. Every claim of exploitation so far is of attempts, probes or honeypot hits, and the named cases do not state php2shell as the cause. Authorities in Singapore and Luxembourg now ask operators to look for traces; the answer will come from those searches, if it comes." }, { "html": "Which sites were really taken offline, and why. The list now draws on more captured reports (Germany's hospitals and hosts, Morocco, Romania, Japan), but most are press accounts; few come from the organisations themselves (the Dutch government, Latvia's agency, Weird Gloop, the Charité's spokesman as quoted). A community tracker counts 51 listed and 50 back." }, { "html": "Whether the 8.5.12 fix is complete. A Fediverse report of a third bug or incomplete fix reached oss-security on 21 October; PHP reportedly told Canonical it is unrelated. On 23 October PHP published an informational advisory for a separate flaw, CVE-2026-115560, in the session upload progress feature, reported by Cloudflare, SOCRadar and The Hacker News: it affects fully patched releases including 8.5.12, needs a rare session setting, will be fixed in the next regular release, and has session.upload_progress.enabled=0 as the mitigation; SOCRadar reports no exploitation and no severity score. PHP's advisory is not in the evidence vault, and whether this is the bug the Fediverse report described is not stated." }, { "html": "What the 70% figure is measured from. None of the three pages that carry it names the measurement." }, { "html": "The model and the method. Calif says no special harness and names no model; OpenAI's blog, which we could not capture, reportedly names GPT-5.6 Sol; Wiz names Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas. What did the models do and what did the people do?" }, { "html": "OpenAI's own blog post, the Patch the Planet launch post, the Spanish and Portuguese advisories and the Techzine piece on Chainguard are all blocked by bot challenges from this capture environment. The block is recorded; the content is not read." } ] }