PHP2Shell: Critical PHP vulnerabilities patched, update now!

Key Points:

• The PHP development team has issued emergency security updates to address two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution on web servers without authentication, affecting all PHP installations serving web requests.
• These vulnerabilities, present for decades but recently exploitable due to AI-assisted techniques, pose one of the most severe risks in PHP’s history, with mod_php setups being particularly vulnerable to unauthenticated attacks.
• The UK’s National Cyber Security Centre recommends taking offline any systems that cannot be patched immediately, highlighting concerns over many embedded and unmaintained PHP installations remaining vulnerable.
• Users are urged to update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible, with backports also provided for PHP 7.4, 8.0, and 8.1; those on unsupported versions should contact their vendors or upgrade promptly.
• The PHP security team advises switching from volunteer-maintained repositories like rpms.remirepo.net to official distribution packages or building PHP from source to ensure timely patching.