importantSYS.SOURCE: The Hacker News• 2026-10-21T19:30:00+05:30

PHP Releases Emergency Patches for Critical PHP2Shell RCE Vulnerabilities

#php #rce #vulnerability

PHP released emergency patches for critical RCE vulnerabilities (PHP2Shell) in its runtime, enabling remote code execution without authentication. The updates (8.5.12, 8.4.27, etc.) are crucial as exploit attempts are reported, and only full updates protect servers.

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server.

The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own

Read original article

*** END OF TRANSMISSION ***

> PHP FOUNDATION ADDRESSES CRITICAL RCE VULNERABILITIES CVE-2026-109618 AND CVE-2026-109619 > OREGON LAWMAKERS APPROVE FUNDING TO PURCHASE ICONIC WATERFALL LISTED ON REDFIN > GITHUB PULL REQUEST AND WEBHOOK DELIVERY DELAYS INCIDENT REPORT > GLOBAL COORDINATION IN VULNERABILITY DISCLOSURE AND PATCH MANAGEMENT > FOURSQUARE CO-FOUNDER REPORTS NO RETURNS FOR EQUITY HOLDERS POST-ACQUISITION > FACEBOOK'S REMOVAL OF NO KINGS GROUP HIGHLIGHTS PLATFORM GOVERNANCE CHALLENGES > DUCKDB 2.0.0 LTS RELEASE WITH ENHANCED SERVER FEATURES AND PERFORMANCE IMPROVEMENTS > COMPROMISED LITELLM 1.107.0 PYPI PACKAGE EMBEDS CREDENTIAL STEALER AND BACKDOOR > AI ADOPTION CHALLENGES FOR MANAGERS: PRODUCTIVITY GAINS VS. NEW OVERSIGHT COMPLEXITIES > PHP RELEASES EMERGENCY PATCHES FOR CRITICAL PHP2SHELL RCE VULNERABILITIES> PHP FOUNDATION ADDRESSES CRITICAL RCE VULNERABILITIES CVE-2026-109618 AND CVE-2026-109619 > OREGON LAWMAKERS APPROVE FUNDING TO PURCHASE ICONIC WATERFALL LISTED ON REDFIN > GITHUB PULL REQUEST AND WEBHOOK DELIVERY DELAYS INCIDENT REPORT > GLOBAL COORDINATION IN VULNERABILITY DISCLOSURE AND PATCH MANAGEMENT > FOURSQUARE CO-FOUNDER REPORTS NO RETURNS FOR EQUITY HOLDERS POST-ACQUISITION > FACEBOOK'S REMOVAL OF NO KINGS GROUP HIGHLIGHTS PLATFORM GOVERNANCE CHALLENGES > DUCKDB 2.0.0 LTS RELEASE WITH ENHANCED SERVER FEATURES AND PERFORMANCE IMPROVEMENTS > COMPROMISED LITELLM 1.107.0 PYPI PACKAGE EMBEDS CREDENTIAL STEALER AND BACKDOOR > AI ADOPTION CHALLENGES FOR MANAGERS: PRODUCTIVITY GAINS VS. NEW OVERSIGHT COMPLEXITIES > PHP RELEASES EMERGENCY PATCHES FOR CRITICAL PHP2SHELL RCE VULNERABILITIES