Urgent security updates for PHP due to serious vulnerabilities

PHP2Shell is the name given to two severe flaws in the PHP runtime. They are tracked as CVE-2026-109618 and CVE-2026-109619. A runtime is important because it helps PHP applications execute their instructions. A weakness there can affect services built on PHP, not just one application.

The article describes attacks that could start with a simple request to a remote computer. Unknown parties could then run commands or read sensitive information from the system’s memory. That makes these flaws more serious than ordinary bugs, because exploitation may reach the computer running the application.

The problems are especially notable because they affect PHP versions dating back to 5.4. Researchers from Wiz, Calif., and Axiom reported that artificial intelligence helped turn old, dormant problems into operational attacks. PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Updating and restarting services is the complete remedy.

The vulnerabilities affect PHP versions going back to PHP 5.4. That broad historical range matters because many systems continue running older PHP releases, potentially leaving long-standing code exposed. The article specifically identifies the 7.4, 8.0, and 8.1 series as older versions needing special source-code fixes.

The official PHP team placed corrections in four releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These are the versions named as containing the necessary official fixes. Installing one of the applicable corrected releases removes the need to rely only on defensive measures described elsewhere.

The article emphasizes that updating alone is not the final operational step. Administrators must also restart services, including PHP management and execution programs. For older series, source-code fixes are available, but the complete solution remains installing the updates and restarting the affected services.

The article describes two especially serious outcomes: an attacker may run commands or read sensitive data from a system’s memory. These actions can expose information already being handled by applications and can let an unknown party interact with the computer running the vulnerable PHP service.

The attack could begin with a simple request to a remote computer. The article does not provide a longer exploitation sequence, but it makes clear that the request could activate the flaws and lead to command execution or memory reading. This is why a runtime vulnerability can have consequences beyond a single web page.

Cloudflare recorded the first online attack attempts before official patches were released. At that time, no successful breaches were confirmed. Organizations still treated the capability as dangerous: several Dutch organizations and government agencies, along with BambooHR, temporarily shut down services as a precaution.

The article says artificial intelligence helped researchers turn old, dormant PHP problems into operational attacks. These were not newly discovered weaknesses in the sense of being newly created. Instead, AI helped make long-standing legacy primitives usable in an attack scenario.

The practical result was significant. An attack could begin with a simple request to a remote computer. Unknown parties could then run commands or read sensitive data from system memory. The source does not describe the exact AI techniques or workflow, so the safest conclusion is that AI helped weaponize existing flaws rather than inventing them.

Researchers from Wiz, Calif., and Axiom discovered and reported the vulnerabilities. Their findings show why old software weaknesses can become newly urgent when attack development becomes easier. Systems that depended on the age or dormancy of a flaw may need renewed attention, especially when older PHP versions remain in use.

Cloudflare recorded the first attempts at online attacks before the official PHP patches were released. No successful breaches had been confirmed at that time. Even so, the presence of attack attempts showed that the vulnerabilities were not merely theoretical concerns.

The flaws could allow unknown parties to run commands on a remote computer or read sensitive data from system memory. That potential impact gave organizations a strong reason to reduce exposure immediately. Several organizations and government agencies in the Netherlands, as well as BambooHR, temporarily shut down their services.

Their decision was described as a precautionary measure, not as a response to confirmed successful intrusions. The episode also shows the value of rapid patching and service controls when a severe vulnerability is being actively tested. The article’s stated complete solution is to install the fixes and restart PHP-related services.

Users of PHP 7.4, 8.0, and 8.1 are not left without a stated protection option. The article says special source-code fixes were released for these older series. This matters because the vulnerabilities affect PHP versions dating back to 5.4, while the main official corrected releases are newer branches.

Administrators should apply the relevant source-code fix for their older version and restart services after making the change. The article specifically mentions PHP management and execution programs. Restarting ensures the running services use the corrected code rather than continuing with an older process.

However, the article calls installation of the updates and restarting services the only complete solution. It also reports that some organizations temporarily shut down services before patches were available. That action can reduce immediate exposure, but it is a precaution, not a replacement for correcting the vulnerable software.

A PHP runtime is the software environment that executes PHP code for an application. It interprets the application’s instructions and manages their interaction with the computer. This explanation uses established software knowledge; the article itself focuses on the runtime flaws and their consequences rather than defining the term.

Because the runtime sits between PHP applications and the underlying system, a serious weakness there can extend beyond one application feature. In this case, the article says a simple request to a remote computer could allow unknown parties to run commands or read sensitive data from system memory.

That combination explains the urgency of the emergency updates. A vulnerable runtime may support many services, so one flaw can create broad exposure wherever the affected PHP version is deployed. The article says fixes require installing corrected versions or older-series source fixes, then restarting PHP management and execution services.