Urgent! PHP Drops Critical Security Fixes for 'PHP2Shell' RCE Flaws

Web administrators globally are scrambling today as PHP, the backbone of nearly 70% of websites, released emergency security updates to fix two critical Remote Code Execution (RCE) flaws, collectively dubbed 'PHP2Shell.' These high-severity vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry a dangerous CVSS v4.0 score of 9.2, allowing attackers to take control of web servers without needing any login or special access. With details of the exploits leaking ahead of time and early attacks already emerging, immediate action is crucial to prevent widespread compromise. The PHP development team published patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 at 14:00 UTC, urging all users to update their systems instantly. The threat is particularly high for servers using Apache with mod_php, where a single unauthenticated request can trigger the attack before any website code even runs. Cybersecurity agencies like the UK's NCSC and the US's CISA have echoed the alarm, recommending organizations patch immediately or, if that's not possible, temporarily take their PHP-based systems offline to avoid exploitation. While patches are now available for supported PHP versions, older, 'End-of-Life' PHP branches will not receive official fixes, leaving millions of websites vulnerable unless their distributions backport updates or they upgrade their entire setup. The rapid emergence of 'Proof-of-Concept' exploits and reports of active probing for weaknesses mean this isn't a threat to defer. Web administrators must prioritize these updates and monitor their systems closely for suspicious activity, as this marks one of the most significant PHP vulnerabilities in years.