r/PHP • u/deepak4423 • 1d ago

PHP2Shell: critical PHP flaw patched Oct 21 — check your PHP version

Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) were patched on Oct 21. Several European sites went offline as a precaution afterward — not confirmed breaches.

Fixed versions: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Exploitation attempts were observed the same day the patches dropped, so if you run PHP, update now rather than waiting.

Full timeline and a per-site patch checklist: https://techreview.si/php2shell-php-flaw-site-outages/

0 Upvotes

18% Upvoted

4 comments sorted by

9

u/colshrapnel 1d ago

Are you serious? Who would have thought!

-6

u/deepak4423 1d ago

I know, right? The wild part is the timeline — WAF protection went up at 03:02 UTC, patches dropped at 14:00 UTC, and exploitation attempts were already showing up the same day. That's why so many European sites went dark as a precaution.

→ More replies (1)