Top stories

PHP released patches on October 21, 2026 for two critical core-runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called php2shell. The flaws affect PHP versions from 5.4 onward and carry a CVSS v4.0 score of 9.2. Specially crafted HTTP requests can enable unauthenticated remote code execution, memory disclosure, denial of service, and data exposure. Because the bugs reside in the PHP runtime rather than application code or plugins, sites using platforms including WordPress, Joomla, Drupal, and Magento can be affected. Calif.io, Wiz, OpenAI, and Quarkslab publicly disclosed the vulnerabilities on October 21. Wiz said the underlying memory-safety issues had existed for decades and that frontier AI models helped researchers construct an exploit chain whose complexity had previously limited practical exploitation. Wiz ranked the flaws among the most severe PHP vulnerabilities it had found. Cloudflare said it deployed default WAF protections for customers on free and paid WAF plans at 3:02 a.m. UTC on October 21, about nine hours before public disclosure. It reported early attacks and payload mutations following an apparent leak of vulnerability details. Cloudflare’s protections use full-transaction detection, combining request and response signals, but the company said WAF mitigation is temporary and administrators must update the PHP runtime to remediate the flaws.