PHP: fixes for two critical remote-code-execution flaws due 21 Oct 14:00 UTC
Update
Patches are out; Amazon says the flaws are broadly exploited
35. Amazon says the flaws, now called PHP2Shell, are broadly exploited, with a first attempt seen on 17 Oct. Cloudflare reported a large wave of attempts after the release.
No crypto platform has reported a compromise from this in the firm alerts we checked. PHP's share of the web is not the same thing as a count of hacked sites.
2 (CVE-2026-109618 and CVE-2026-109619). CERT-EU and the Australian Cyber Security Centre published alerts. SlowMist alerted crypto teams and says it scanned PHP-related assets. Official affected versions were not published at our check.
CERT-EU had not reported active exploitation at that time. net, CERT-EU, and SlowMist.
369 take
If a site or API actually runs PHP, update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and review logs back to 17 Oct. A firewall rule is a stopgap. Apps that are not PHP are outside this flaw.
Sources