---
id: "CVE-2026-109619"
kind: "vulnerability"
aliases: ["CVE-2026-109619"]
title: "PHP: stale request-memory state lets a later request run code"
severity: "critical"
cvss: 9.2
epss: 0.05991
exploited: true
status: "resolved"
category: "runtime"
products: [{"name": "php", "fixed": ["8.2.35"], "affected": ">= 5.4.0, < 8.2.35", "ecosystem": "vendor"}, {"name": "php", "fixed": ["8.3.36"], "affected": ">= 8.3.0, < 8.3.36", "ecosystem": "vendor"}, {"name": "php", "fixed": ["8.4.27"], "affected": ">= 8.4.0, < 8.4.27", "ecosystem": "vendor"}, {"name": "php", "fixed": ["8.5.12"], "affected": ">= 8.5.0, < 8.5.12", "ecosystem": "vendor"}, {"name": "siemens ruggedcom ape1808 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["10.2.7"], "affected": ">= 10.2.0, < 10.2.7", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.7", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.8", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.9", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.10", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.11", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.12", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.13", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.14", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.15", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.16", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.17", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.18", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["11.1.4"], "affected": ">= 11.1.0, < 11.1.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.5", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.6", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.7", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.8", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.9", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.10", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.11", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.12", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.13", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.14", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.15", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.16", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["11.2.4"], "affected": ">= 11.2.0, < 11.2.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.5", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.6", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.7", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.8", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.9", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.10", "ecosystem": "vendor"}, {"name": "php", "fixed": ["8.2.35"], "affected": ">= 8.2.0, < 8.2.35", "ecosystem": "vendor"}, {"name": "php", "fixed": [], "affected": ">= 5.4.0, <= 8.1.x (end of life)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["web-servers", "php-fpm", "cloudflare", "akamai", "self-hosted", "nginx", "runtime", "openai", "aws", "poc-public", "mod_php", "lab-disclosure", "apache", "php"]
not_affected_if: ["no-php-installed", "patched-php-version"]
published_at: "2026-10-21T00:00:00+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T05:21:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109619", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:30:53+00:00"}, {"source": "lab", "url": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities", "first_seen_at": "2026-10-24T00:16:52+00:00"}, {"source": "github-poc", "url": "https://github.com/Taz1920/cve-2026-109619", "first_seen_at": "2026-10-24T03:01:18+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-109619", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "github-poc", "url": "https://github.com/utkarsssh17/cve-2026-109619-php-uaf-poc", "first_seen_at": "2026-10-24T17:09:11+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/", "first_seen_at": "2026-10-24T17:18:15+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/", "first_seen_at": "2026-10-24T17:18:15+00:00"}, {"source": "lab", "url": "https://blog.cloudflare.com/full-transaction-waf/", "first_seen_at": "2026-10-24T17:18:15+00:00"}, {"source": "lab", "url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/", "first_seen_at": "2026-10-24T17:18:15+00:00"}, {"source": "lab", "url": "https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html", "first_seen_at": "2026-10-24T17:33:06+00:00"}, {"source": "lab", "url": "https://www.akamai.com/blog/security-research/2026/oct/beyond-day-zero-akamai-rapid-response-ai-threat-intelligence", "first_seen_at": "2026-10-24T18:43:45+00:00"}, {"source": "lab", "url": "https://www.akamai.com/blog/security-research/2026/oct/critical-remote-code-execution-vulnerabilities-php-core", "first_seen_at": "2026-10-24T18:43:45+00:00"}, {"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/", "first_seen_at": "2026-10-24T19:12:58+00:00"}, {"source": "github-poc", "url": "https://github.com/mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell-", "first_seen_at": "2026-10-24T23:50:57+00:00"}]
---

# PHP: stale request-memory state lets a later request run code

PHP keeps stale memory state from one request and can reuse it in a later request, which lets an attacker run code on the server. The sources report public proof-of-concept exploits and exploitation in the wild, and they list fixed releases for each supported PHP branch.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:php affected >= 5.4.0, < 8.2.35 fixed 8.2.35
- vendor:php affected >= 8.3.0, < 8.3.36 fixed 8.3.36
- vendor:php affected >= 8.4.0, < 8.4.27 fixed 8.4.27
- vendor:php affected >= 8.5.0, < 8.5.12 fixed 8.5.12
- vendor:siemens ruggedcom ape1808 firmware affected ? fixed ?
- vendor:paloaltonetworks pan-os affected >= 10.2.0, < 10.2.7 fixed 10.2.7
- vendor:paloaltonetworks pan-os affected = 10.2.7 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.8 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.9 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.10 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.11 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.12 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.13 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.14 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.15 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.16 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.17 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.18 fixed ?
- vendor:paloaltonetworks pan-os affected >= 11.1.0, < 11.1.4 fixed 11.1.4
- vendor:paloaltonetworks pan-os affected = 11.1.4 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.5 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.6 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.7 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.8 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.9 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.10 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.11 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.12 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.13 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.14 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.15 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.16 fixed ?
- vendor:paloaltonetworks pan-os affected >= 11.2.0, < 11.2.4 fixed 11.2.4
- vendor:paloaltonetworks pan-os affected = 11.2.4 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.2.5 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.2.6 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.2.7 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.2.8 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.2.9 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.2.10 fixed ?
- vendor:php affected >= 8.2.0, < 8.2.35 fixed 8.2.35
- vendor:php affected >= 5.4.0, <= 8.1.x (end of life) fixed ?

## How to check

- Run `php -v` on each host, container and PHP-FPM image and compare the version with the fixed releases below.
- Check the PHP version your web server actually loads, since mod_php and php-fpm can differ from the CLI build.
- Vendor-packaged PHP may carry a backported fix without a version bump, so check the distro advisory as well.

## Fix

- Upgrade PHP to `8.2.35`, `8.3.36`, `8.4.27` or `8.5.12` (or later) on the branch you run.
- Until patched, WAF rules from Cloudflare and AWS Managed Rules are listed as interim protection, but the sources say they have limits.
- After upgrading, restart php-fpm and the web server, then confirm the running version.

## Mitigated for you by

- AWS (platform-fix): covers AWS Elastic Beanstalk PHP platforms 8.2 through 8.5 with the upstream PHP fix Limits: none stated Still: Enable Managed Platform Updates, or manually update the environment platform version https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/
- AWS (platform-fix): covers Updated PHP packages available in all regions for Amazon Linux Limits: none stated Still: Apply the updated PHP packages as soon as available https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/
- AWS (platform-fix): covers Updated Lightsail blueprints available in all regions Limits: AWS cannot update running Lightsail instances in place Still: Create new instances from the updated blueprints and migrate applications https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/
- AWS (platform-fix): covers AWS-operated WorkMail service upgraded to PHP 8.3.36 with configuration-level controls applied Limits: none stated Still: No customer action required https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/
- Team (workaround): covers New EMR on EC2 clusters launched without Ganglia Limits: Existing clusters with Ganglia remain affected; EMR 7.0.0+ and clusters without Ganglia are not affected Still: Omit Ganglia when launching new clusters when not required; upgrade to EMR 7.x where possible https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/
- AWS (waf-rule, since 2026-10-21): covers HTTP requests inspected by AWS WAF using the PHP Managed Rule Group (default version), including requests matching CVE-2026-109619 via rule PHP2Shell_BODY, and CVE-2026-109618 as well as CVE-2026-109619 per the security bulletin. Limits: Patching is the only complete fix; the document does not state other limits Still: Use the default managed rule group version, or update a pinned version to the latest; still upgrade PHP as first priority https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/
- Akamai (waf-rule, since 2026-10-21): covers Requests proxied through Akamai App & API Protector detected by Adaptive Security Engine rule 3000991 v1 (PHP Remote Code Execution Attack Detected), HTTP requests at Akamai's edge protected by Rapid Rule 3000991 (deployed network-wide in Alert mode at 10:00 AM ET, switched to deny at 1:36 PM ET on Oct 21, 2026), and weaponized payloads for these PHP flaws mitigated by App & API Protector's existing command injection rules. Limits: None stated. Still: Upgrade to the patched PHP releases and apply vendor patches promptly; the WAF rules (3000991 and existing command injection rules) are stopgaps or an important extra layer for organizations that cannot patch immediately, but patches remain essential. https://www.akamai.com/blog/security-research/2026/oct/critical-remote-code-execution-vulnerabilities-php-core
- Cloudflare (waf-rule, since 2026-10-21): covers HTTP requests proxied through Cloudflare, matched by Cloudflare Managed Ruleset rules for CVE-2026-109618 and CVE-2026-109619 (on Professional, Business, and Enterprise plans in block mode) and by Cloudflare Managed Free Ruleset rules for the same CVEs (on Free plans), including seven rules named 'PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)' set to Block Limits: Traffic not proxied through Cloudflare; customers whose Managed Ruleset is not in block mode; customers who override the ruleset behavior; the rules name only CVE-2026-109618 and CVE-2026-109619; the 2026-10-22 changelog says detection logic and rule actions are unchanged and only rule metadata and descriptions were updated; the changelog does not say the PHP runtime is patched Still: Patch the PHP runtime; keep the WAF protection enabled and confirm the Managed Ruleset deploys in block mode while patching; the changelog entries state no further customer action https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/
- Cloudflare (waf-rule, since 2026-10-21): covers Origin HTTP responses to requests proxied through Cloudflare that match php2shell detections in the Cloudflare Managed Response Firewall Default ruleset, blocked before reaching the requester, deployed on all plans including Free Limits: Only responses matching the detection; does not undo actions already performed at the origin; the document names no CVE ids and does not confirm php2shell is one of the listed flaws; traffic not proxied through Cloudflare is not covered; the document does not state coverage of non-HTTP paths Still: Patch the PHP runtime; keep the response rules active while patching; if false positives occur, restrict the managed ruleset's scope to specific paths; the document does not say the ruleset replaces patching PHP https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109619
- 2026-10-23T22:30:53+00:00 analyst — Read php-src GHSA-6wmf-4rv5-p3rp and PHP Foundation post: fixed in 8.2.35/8.3.36/8.4.27/8.5.12; 8.1 and earlier EOL, unpatched. watchTowr/SANS report exploitation attempts (PHP2Shell); public PoCs exist. Caution: the linked TheHackersNews post claims session.upload_progress.enabled=0 means 'no further action' for this CVE; the advisory says that only covers one path and only patching is reliable. PAN-OS/Siemens product entries from NVD feed not verified by me.
- 2026-10-24T00:16:52+00:00 lab https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities — OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities | OpenAI
- 2026-10-24T03:01:18+00:00 github-poc https://github.com/Taz1920/cve-2026-109619
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-109619
- 2026-10-24T17:09:11+00:00 github-poc https://github.com/utkarsssh17/cve-2026-109619-php-uaf-poc
- 2026-10-24T17:18:15+00:00 lab https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/ — Cloudflare: WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset · Changelog
- 2026-10-24T17:18:15+00:00 lab https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/ — Cloudflare: WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset · Changelog
- 2026-10-24T17:18:15+00:00 lab https://blog.cloudflare.com/full-transaction-waf/ — Cloudflare: Introducing full transaction detection for Cloudflare WAF | Cloudflare Blog
- 2026-10-24T17:18:15+00:00 lab https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ — Cloudflare: Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog
- 2026-10-24T17:33:06+00:00 lab https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html — AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director
- 2026-10-24T18:43:45+00:00 lab https://www.akamai.com/blog/security-research/2026/oct/beyond-day-zero-akamai-rapid-response-ai-threat-intelligence — Akamai: Beyond Day Zero: Akamai's Rapid Response and AI Threat Intelligence
- 2026-10-24T18:43:45+00:00 lab https://www.akamai.com/blog/security-research/2026/oct/critical-remote-code-execution-vulnerabilities-php-core — Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai
- 2026-10-24T19:12:58+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/ — AWS: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
- 2026-10-24T23:50:57+00:00 github-poc https://github.com/mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell-

## Documents

- [advisory] GHSA-6wmf-4rv5-p3rp: RCE via stale global state (php-src) https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- [advisory] OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities | OpenAI https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities
- [advisory] Cloudflare: WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset · Changelog https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/
- [advisory] Cloudflare: WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset · Changelog https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/
- [advisory] Cloudflare: Introducing full transaction detection for Cloudflare WAF | Cloudflare Blog https://blog.cloudflare.com/full-transaction-waf/
- [advisory] Cloudflare: Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
- [advisory] AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html
- [advisory] Akamai: Beyond Day Zero: Akamai's Rapid Response and AI Threat Intelligence https://www.akamai.com/blog/security-research/2026/oct/beyond-day-zero-akamai-rapid-response-ai-threat-intelligence
- [advisory] Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai https://www.akamai.com/blog/security-research/2026/oct/critical-remote-code-execution-vulnerabilities-php-core
- [advisory] AWS: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/
- [describes] CERT-EU: Critical Vulnerabilities in PHP https://www.cert.europa.eu/publications/security-advisories/2026-018/
- [describes] AWS bulletin: PHP web runtimes https://aws.amazon.com/security/security-bulletins/2026-143-aws/
- [discussion] @sans_isc: SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Ex https://x.com/sans_isc/status/2113088117091823956
- [discussion] @watchtowrcyber: yes, we mean CVE-2026-109618 and CVE-2026-109619 https://x.com/watchtowrcyber/status/2112613730848809170
- [discussion] @watchtowrcyber: Watch now: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploitation attempts ar https://x.com/watchtowrcyber/status/2113585201880113451
- [discussion] @sans_isc: Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) https://t.co/BgXfR https://x.com/sans_isc/status/2112893906035626040
- [discussion] @TheHackersNews: PHP has a one-line mitigation for CVE-2026-115560:

session.upload_progress.enab https://x.com/TheHackersNews/status/2113603143561093367
- [discussion] @SocketSecurity: Good news, everyone!

PHP2Shell exploits are a massive fail (so far) 🤞 https://t https://x.com/SocketSecurity/status/2113696934372245885
- [discussion] @TheHackersNews: The new PHP flaw is separate from the two critical #PHP2Shell bugs patched on Oc https://x.com/TheHackersNews/status/2113602912530444768
- [discussion] @clintgibler: 📚tl;dr sec 351

😈 PHP2Shell, 
🧑🏻‍💻 Autopatching Skills, 
🤖 AWS Pathrunner

https https://x.com/clintgibler/status/2113718227817881675
- [discussion] @eastdakota: Some stats on #php2shell. In the 10 hours before it was publicly announced, acro https://x.com/eastdakota/status/2113079352682570051
- [discussion] @rauchg: It was inspiring to watch the behind-the-scenes¹ of the industry coming together https://x.com/rauchg/status/2112989629536440400
- [discussion] @troyhunt: Have we seen any documented breaches / exploitation traced back to either PHP2Sh https://x.com/troyhunt/status/2113364817037975914
- [discussion] @vxunderground: Lots of arguments online surrounding who truly discovered PHP2Shell, who gets th https://x.com/vxunderground/status/2113540887380963480
- [discussion] @vxunderground: Today silly shenanigans:
- PHP2shell, leak, bad stuff
- Something about Railway? https://x.com/vxunderground/status/2113086117927178490
- [discussion] @craiu: A new IP seen trying to exploit #PHP2shell - 85.11.167[.]243 https://x.com/craiu/status/2113579352470479184
- [discussion] @craiu: Keeping track of all #PHP2Shell things, IOCs, log artifacts, exploitation status https://x.com/craiu/status/2112924512471953730
- [discussion] @rez0__: My non-hacking buddy asked me how much the person who found the php2shell made.  https://x.com/rez0__/status/2113262565983973773
- [discussion] @sans_isc: (Reliable)? php2shell exploitability https://t.co/D8svpFnNqg https://t.co/cvK5zi https://x.com/sans_isc/status/2113723736214180323
- [discussion] @sans_isc: SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal https://x.com/sans_isc/status/2113577565160182077
- [discussion] @watchtowrcyber: Congratulations to the team at @calif_io (specifically @lcfr_hax)  for the disco https://x.com/watchtowrcyber/status/2112923764270768398
- [discussion] A small audit script and config notes for the new PHP CVEs https://news.ycombinator.com/item?id=50210997
- [discussion] A tale of two PHP remote vulnerabilities https://news.ycombinator.com/item?id=50203437
- [discussion] Why governments pulled websites offline over the decades-old PHP language https://news.ycombinator.com/item?id=50199203
- [discussion] Re: Hours later – No, there is an easy way to exploit this vulnerability https://news.ycombinator.com/item?id=50195017
- [discussion] PHP2Shell: Critical PHP Vulnerabilities, What to Do About Them https://news.ycombinator.com/item?id=50194701
- [discussion] A tale of two PHP remote vulnerabilities https://news.ycombinator.com/item?id=50188558
- [discussion] Your Sites Are Protected Against the PHP2Shell Vulnerabilities https://news.ycombinator.com/item?id=50183570
- [discussion] PHP2Shell: Critical PHP RCE Vulnerabilities Explained https://news.ycombinator.com/item?id=50182037
- [discussion] Cloudflare deploys protections against php2shell vulnerability https://news.ycombinator.com/item?id=50181326
- [discussion] A tale of two PHP remote vulnerabilities https://news.ycombinator.com/item?id=50181037
- [discussion] Simple Proxy to secure your PHP from PHP2Shell vulnerability https://news.ycombinator.com/item?id=50180810
- [discussion] PHP2Shell: Critical Vulnerabilities in PHP https://news.ycombinator.com/item?id=50178312
- [discussion] PHP2Shell https://news.ycombinator.com/item?id=50175425
- [discussion] PHP2Shell (CVE-2026-109618) Exploit https://news.ycombinator.com/item?id=50204912
- [discussion] PHP2Shell Needs One HTTP Request. OpenNHP Never Lets It Arrive https://news.ycombinator.com/item?id=50204453
- [discussion] Php2shell is not exploitable in real production enviroment https://news.ycombinator.com/item?id=50199595
- [discussion] Amazon says PHP2Shell exploitation began 4 days before patches https://news.ycombinator.com/item?id=50195054
- [discussion] Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure https://news.ycombinator.com/item?id=50194070
- [discussion] @doublepulsar.com: PHP2Shell thread: cyberplace.social/@GossiTheDog... https://bsky.app/profile/doublepulsar.com/post/3myjwllyrt226
- [discussion] @campuscodi.risky.biz: -Supply chain attack lets ransomware group inside 40+ shipping companies
-Pentag https://bsky.app/profile/campuscodi.risky.biz/post/3myjwkqr4bc2q
- [discussion] @Hacker0x01: 🚨 Fixes are out for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-20 https://x.com/Hacker0x01/status/2112955127283712456
- [discussion] @CFchangelog: Emergency update to the Cloudflare Managed Ruleset on 2026-10-22 refines metadat https://x.com/CFchangelog/status/2113714815885885868
- [discussion] @calif_io: Just in case it wasn’t clear: we popped the iPhone Duo on release day, adding a  https://x.com/calif_io/status/2113578130543882697
- [discussion] @calif_io: Do you know who illustrated the comic on https://t.co/KEUVez9rnN?

Her name is S https://x.com/calif_io/status/2112919199437770878
- [discussion] @calif_io: Let’s set the record straight: @lcfr_hax was the first to discover php2shell and https://x.com/calif_io/status/2112914613297668583
- [discussion] @gdb: Over the past two months, we have been leading a coalition to mitigate one of th https://x.com/gdb/status/2112921529650688312
- [discussion] @wiz_io: AI tools helped find one of the most severe online bugs ever #php2shell 

In our https://x.com/wiz_io/status/2112921894647156772
- [discussion] @wiz_io: PHP2Shell marks an inflection point: AI changes the practical exploitability of  https://x.com/wiz_io/status/2112899825305780607
- [discussion] @wiz_io: 🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerab https://x.com/wiz_io/status/2112899813264277528
- [discussion] @xbow: PHP2Shell just showed us how quickly defenders need to act. What should they be  https://x.com/xbow/status/2113327462629220580
- [discussion] @xbow: PHP2Shell: just another critical vulnerability but on a much faster clock...

AI https://x.com/xbow/status/2113003403940929926
- [discussion] @CISAgov: Update to #PHP2Shell Alert:  SIGMA rule helps identify potentially suspicious ac https://x.com/CISAgov/status/2113984287481716741
- [discussion] @CloudflareDev: ⚠️ Vulnerability alert: php2shell

Unpatched sites running PHP 5.4 or later are  https://x.com/CloudflareDev/status/2113004792880693280
- [fix] PHP Foundation: Today's PHP security release https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
- [mentions] PHP2Shell: detection, analysis, remediation (Datadog Security Labs) https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/
- [mentions] Red Hat RHSB-2026-013 php2shell https://access.redhat.com/security/vulnerabilities/RHSB-2026-013
- [poc] Ghost-Bx1/POC-CVE-2026-109618-CVE-2026-109619-CVE-2024-4577 https://github.com/Ghost-Bx1/POC-CVE-2026-109618-CVE-2026-109619-CVE-2024-4577
- [poc] Taz1920/cve-2026-109619 https://github.com/Taz1920/cve-2026-109619
- [poc] vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy https://github.com/vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy
- [poc] utkarsssh17/cve-2026-109619-php-uaf-poc https://github.com/utkarsssh17/cve-2026-109619-php-uaf-poc
- [poc] saaudsdk/php2shell-cve-2026-109618-109619-fix https://github.com/saaudsdk/php2shell-cve-2026-109618-109619-fix
- [poc] akamor2800/php-5.4-cve-2026-php2shell-patch https://github.com/akamor2800/php-5.4-cve-2026-php2shell-patch
- [poc] mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell- https://github.com/mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell-
- [poc] GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619 https://github.com/GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619

## From the sources

Patch the Planet: global response coordination as agents uncover critical vulnerabilities | OpenAI

October 21, 2026

# Patch the Planet: global response coordination as agents uncover critical vulnerabilities

Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications. Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet⁠(opens in a new window) initiative, with Wiz also independently discovering and reporting both vulnerabilities. PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure.

For organizations using PHP, the priority now is applying the fixes. We’re sharing a PHP version checker as a Codex skill⁠(opens in a new window) to help operators identify potentially vulnerable PHP versions and, alongside PHP’s and their providers’ guidance, determine which updates apply.

Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory. It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.

To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure.

To help more defenders use these capabilities, we’ve committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services.

As significant as they are, these bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months. Drawing on our experience thus far, we’re sharing a proposed approach, appropriate for the AI era, to responding to critical vulnerabilities in widely used software, and we’re asking the security community to help improve this framework. It brings together our models, security expertise, and maintainers to help turn findings into protection and build a response that can scale as AI capabilities advance.

## Coordinating a global response

Getting a fix into use can mean adapting it for older releases, preparing provider mitigations, and updating systems across many organizations. A repeatable process helps those teams act quickly as more vulnerabilities are discovered.

Through Patch the Planet, we contributed security expertise and model access to support the PHP response, and worked with maintainers and research partners to test fixes and prepare guidance. We also helped coordinate with infrastructure providers on protections for affected systems and engaged government cyber agencies to help guidance reach critical organizations. This supported the maintainer-led response and helped other defenders prepare.

For some findings, researchers can work directly with the software’s maintainers to investigate the issue and develop a fix. Others need a wider response because they affect many products or because distributors and service providers need time (which may be in short supply if frontier capabilities are not too far ahead of those that are broadly available) to prepare updates and protections. In those cases, the proposed framework can help maintainers identify who needs to be involved and coordinate the work. The response can involve five stages:

- Validate and fix the upstream vulnerability. The maintainer, researchers, and essential technical partners confirm the finding, assess its impact, and develop and test a fix. This process includes adversarial testing with frontier models to look for ways around the patch and related variants of the vulnerability. 
- Give affected organizations time to act. We propose a framework for considering which organizations need advance information to prepare protections, while maintainers decide whom to involve. We help with outreach, information-sharing agreements, and coordination between teams. A distributor might adapt a fix for an older release, a hosting provider might test a mitigation, and a security provider might prepare detection or prevention measures, including web application firewall (WAF) rules. 
- Coordinate with government partners to help protect critical systems. Government agencies play an essential role in coordinating a wider response and helping security guidance reach organizations responsible for critical infrastructure and other essential services. In the case of PHP, we worked, in collaboration with our partners, to engage with multiple parts of the U.S. government, including the White House’s Super Intelligence Force, the Office of the National Cyber Director (ONCD), the Cybersecurity and Infrastructure Security Agency (CISA), as well as international partners to support that effort.
- Prepare updates across affected products. As the fix, guidance, and disclosure plans become stable, maintainers can involve additional distributors, hosting and service providers, response teams, and operators to prepare updates and address gaps in coverage.
- Once a patch is available, publish guidance and support deployment. Public guidance helps people assess their exposure, find authoritative updates or interim mitigations, and check that a fix is running. The response continues as operators deploy updates and report where they need help.

The proposed framework considers an organization’s protective role, including protecting its own systems and customers, the time needed to act, and its ability to handle sensitive information. The same criteria would apply to comparable organizations, with maintainers deciding whom to involve ahead of disclosure.

Each participant receives the information needed to carry out their protective work, from network logs with indicators of compromise to more sensitive working proof-of-concept exploits. Even limited details can reveal a vulnerability, so we weigh the risk of sharing them against the protection they enable.

Teams following this framework would work with maintainers to give defenders time to prepare and reassess the timeline if there’s active exploitation in the wild, a leak, a revealing public patch, or increased risk to users from stalled remediation.

The Patch the Planet website⁠(opens in a new window) brings together public disclosures and guidance to help operators identify affected systems, find the right update, and verify that the updated software is running properly. For PHP, it points to the maintainers’ official patch and upgrade instructions and our partners’ technical research. The guidance also covers interim mitigations, when to involve a provider or expert, and backup and recovery. Interim protections can reduce risk, but we’ll make their limits and operational tradeoffs clear. 

Operators can use CISA’s guidance on prioritization and remediation⁠(opens in a new window) to assess how quickly to act based on exposure, exploitation, and potential impact. That may mean emergency patching, immediate mitigation, or a planned update, alongside forensic triage where warranted to assess whether systems have already been compromised. Priorities should be reassessed as conditions change, with a clear path to lasting remediation. 

## Giving maintainers the capacity and resources to respond

Global coordination depends on the people who maintain the software. Many projects are run by small teams that review security reports alongside routine development. Those teams need help separating new issues from duplicates, assessing impact, and testing fixes across supported releases. We support that work with fundi

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_