Security advisories

Fact-checked against primary sources. Updated as the event unfolds. Every change is dated. What this feed does

• CRITICAL Published 21 Oct 2026 Last checked 21 Oct 2026

  PHP2Shell: two critical PHP core RCEs, patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35

  CVE-2026-109618 and CVE-2026-109619, CVSS 9.2, unauthenticated remote code execution in PHP itself. Fixes released 21 Oct 2026; backports exist for 7.4, 8.0 and 8.1; PHP says there are no complete mitigations. Early attack attempts reported.

  • PHP security advisory (primary)
  • BleepingComputer
  • Help Net Security
  Read the advisory