{"type":"analysis","id":"analysis:research-php-confirms-two-critical-php2shell-rce-flaws-patch-to-8-5-12-8-4-27-8-3-36-or","slug":"research-php-confirms-two-critical-php2shell-rce-flaws-patch-to-8-5-12-8-4-27-8-3-36-or","title":"PHP confirms two critical PHP2Shell RCE flaws; patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now","description":"PHP's own advisories confirm that CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution, and that only upgrading fully fixes them. Exploit details leaked early and attack attempts began before the patches shipped. No confirmed real-world compromise has been reported so far.","published_at":"2026-11-09T00:00:00.000Z","updated_at":"2026-11-09T00:00:00.000Z","record_date":"2026-11-09","topics":["memory","openai","research"],"source_urls":["https://www.php.net/archive/2026.php","https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote","https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749","https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/","https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws"],"language":"en","routes":{"html":"https://newruntime.com/analysis/research-php-confirms-two-critical-php2shell-rce-flaws-patch-to-8-5-12-8-4-27-8-3-36-or/","markdown":"https://newruntime.com/analysis/research-php-confirms-two-critical-php2shell-rce-flaws-patch-to-8-5-12-8-4-27-8-3-36-or.md","json":"https://newruntime.com/analysis/research-php-confirms-two-critical-php2shell-rce-flaws-patch-to-8-5-12-8-4-27-8-3-36-or.json"},"author":{"role":"author","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"editorial_provenance":{"desk":"authorial","target_ref":"deep_research:81d5ffbc-842f-427f-a1a7-3bfa28eb7791","authorial_article_id":"81d5ffbc-842f-427f-a1a7-3bfa28eb7791"},"next_reads":[{"type":"topic","path":"/topics/memory/","url":"https://newruntime.com/topics/memory/","title":"Memory","reason":"Explore the memory topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/memory.md","json_url":"https://newruntime.com/topics/memory.json"},{"type":"collection","path":"/analysis/","url":"https://newruntime.com/analysis/","title":"Analysis","reason":"Open the latest authorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/analysis.json"},{"type":"collection","path":"/sources/","url":"https://newruntime.com/sources/","title":"Sources","reason":"See the original sources this archive cites.","media_type":"text/html"}]}