PHP Releases Emergency PHP2Shell Security Fixes

PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, vulnerabilities rated 9.2 under CVSS v4.0 that could allow unauthenticated attackers to execute code and potentially access files, databases and connected services. Exploit details leaked before the planned patch release, and researchers said AI tools helped identify or demonstrate ways to exploit the underlying memory-handling flaws; Cloudflare reported early attack attempts and introduced temporary firewall protections. Fixes are available for PHP 8.2 through 8.5, with source backports for some older releases, and operators were urged to check embedded PHP in appliances and other infrastructure as well as public-facing websites. The NSA and PHP maintainers urged operators to install updates immediately or take vulnerable systems offline; Finland and the Netherlands took some public-facing government websites offline as a precaution, while Australian officials said they had no confirmed exploitation. The temporary protections are not a substitute for updates.