Urgent security updates for PHP due to serious vulnerabilities

The PHP project released emergency patches for two severe runtime vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, affecting versions back to PHP 5.4. Fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source-code patches for the 7.4, 8.0 and 8.1 branches. Researchers from Wiz and OpenAI who reported the flaws said AI helped turn decades-old dormant primitives into operational attacks that could let remote parties run commands or read sensitive memory, and Cloudflare recorded early exploitation attempts before the patches landed.

PHP has released emergency updates for two severe runtime flaws named PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. Affecting versions back to PHP 5.4, the issues highlight risks where AI assists in weaponizing legacy primitives. Fixes land in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Researchers from Wiz, Calif., and OpenAI who discovered and reported the vulnerabilities noted that artificial intelligence helped turn decades-old, dormant problems into operational attacks. These attacks could begin with a simple request to a remote computer, allowing unknown parties to run commands or read sensitive data from the system's memory. The official PHP team has released the necessary fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For older versions, such as the 7.4, 8.0 and 8.1 series, special source code fixes have been released. The only complete solution is to install the updates and restart services, such as the PHP management and execution programs. Before the official release of the patches, Cloudflare recorded the first attempts at online attacks, but no successful breaches were confirmed at that time. As a precautionary measure, several organizations and government agencies in the Netherlands, as well as companies such as BambooHR, temporarily shut down their services. G Hacks.gr on Google Set it as a preferred source for cybersecurity updates. Preferred source