PHP

Global – October 31, 2026 -- CrowdStrike Counter Adversary Operations has observed no successful exploitation of the PHP2Shell vulnerabilities in the wild or in its honeypot environments, only testing, probing and unsuccessful attempts.

The firm has also found no fully weaponized exploit, and no proof-of-concept (POC) exploit sufficient for widespread exploitation. Opportunistic attackers are likely to favor proven alternatives, because several other vulnerabilities already deliver unauthenticated remote code execution (RCE) against PHP applications reliably and at scale.

PHP disclosed two CVEs affecting four release branches on October 21, 2026

CVE-2026-109618 and CVE-2026-109619 affect PHP versions earlier than 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Preliminary analysis by industry sources and the vendor indicates that many older versions, including end-of-life releases, are also affected and may receive only limited patches.

Global – October 29, 2026 -- Five days after the PHP project shipped emergency fixes for the PHP2Shell flaws, 93.6% of measurable PHP instances remain exposed, according to OX Security scans run through October 26, 2026. That is roughly 15 of every 16 hosts the firm can measure.

The PHP project released the fixes on October 21 for CVE-2026-109618 and CVE-2026-109619. Together, the two critical flaws let an unauthenticated attacker execute code remotely inside the PHP engine. Security agencies issued urgent advisories, and some organizations took systems offline while assessing their exposure.

Global – October 29, 2026 -- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS score of 9.2 and let unauthenticated attackers run code on web servers. Cyber insurer Coalition says its honeypots recorded exploit-related requests more than five hours before PHP released its fix, and it expects exploitation at scale.

PHP published its advisory on October 21, a day earlier than planned after details leaked online. The flaws sit in PHP itself rather than in any single application. Attackers can also read passwords, authentication tokens, API keys and certificates from server memory without taking over the server.

Global – October 27, 2026 -- PHP will ship an emergency patch for two critical core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Wednesday, October 21, 2026, at 14:00 UTC (10:00 ET). The PHP security team rates both flaws CVSS v4.0 9.2, and researchers describe them as unauthenticated remote code execution.

PHP reserves the right to release before 14:00 UTC

The project may ship earlier if technical details go public or exploitation appears in the wild, according to BleepingComputer. The official advisory names no vulnerable function, no affected versions and no fixed releases.

The CVE IDs, the "PHP 5 through 8" scope and the CVSS 10 figures come from researchers and a leak, not from PHP. Until the release, everything outside the official advisory remains theory.

Global – October 27, 2026 -- Roughly 2,000,000 internet-facing PHP servers run versions affected by two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, and 99.99% of identifiable servers remain unpatched, according to Shodan data cited by OX Security.

The PHP core team issued an out-of-band security release fixing both flaws in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Shodan counts only servers that expose their PHP version, so the real total is likely higher.

69% of exposed servers run versions that will never get an official fix

About 1.37 million servers, or 69%, run old PHP versions outside vendor support. Only 245 servers showed a patched version as of the Shodan snapshot. Affected code spans all versions supporting session.upload_progress, from PHP 5.4.0 up to the unpatched releases.