Key points
- PHP maintainers released emergency patches for CVE-2026-109618 and CVE-2026-109619 on Wednesday.
- The flaws, found by researchers using AI models, enable unauthenticated remote code execution.
- Chainguard is accused of leaking CVE IDs, forcing an early disclosure ahead of the planned Thursday release.
The PHP2shell vulnerabilities allow attackers to execute arbitrary code on servers running the PHP scripting language without needing any authentication credentials. Because PHP powers a significant portion of the public web infrastructure, these unauthenticated remote code execution flaws pose an immediate and widespread risk to online services and applications that rely on the platform.
PHP maintainers published emergency patches on Wednesday, just hours after releasing a blog post detailing the discovery and resolution process. The two security holes, tracked as CVE-2026-109618 and CVE-2026-109619, were identified by researchers from Calif, OpenAI, and Wiz between August and September. All three organizations confirmed they utilized artificial intelligence models to uncover these specific security weaknesses in the open-source software.
What we know
According to The Register, PHP developers accused supply chain security firm Chainguard of disrupting the coordinated disclosure process by effectively revealing the bugs ahead of schedule. The issue began on Tuesday around 15:00 UTC when the two CVE IDs started circulating on online forums and social media platforms. These rumors included incorrect information regarding the release timing and the CVSS severity rating, though no technical details about the exploits were leaked at that time.
The premature circulation of identifiers forced PHP maintainers to move their planned disclosure from Thursday to Wednesday. The PHP Foundation stated that distributors were still packaging the fixes, meaning an immediate release would have left many users without an easy update path. Moving the release forward by one day was deemed the best compromise between acting quickly, allowing preparation time, and ensuring a simple update mechanism for everyone.
Defender's checklist
- Verify current PHP versions against the newly released emergency patches for CVE-2026-109618 and CVE-2026-109619.
- Monitor server logs for unusual activity or unauthorized code execution attempts targeting PHP endpoints.
- Confirm that all web servers have successfully applied the updates before the end of the current business day.
- Review access controls to ensure no unauthenticated endpoints are exposed to the public internet unnecessarily.
What analysts watch for
Teams usually examine web server logs for anomalous request patterns that indicate unauthenticated access attempts or payload injection. Analysts check whether the malware establishes persistence by modifying configuration files or creating new user accounts. They also monitor network traffic for command-and-control beaconing that might originate from compromised PHP processes. Investigating the initial entry point helps determine if the attack leveraged known vulnerabilities or zero-day flaws in the supply chain.
What to do and how to stay safe: PHP
- Apply the emergency PHP patches immediately to close the remote code execution gaps identified in CVE-2026-109618 and CVE-2026-109619.
- Audit your server configurations to ensure that PHP versions are up to date and that unnecessary modules are disabled.
- Monitor network traffic and server logs for signs of exploitation attempts, particularly from unauthenticated sources.
- Once the vendor provides further updates, review their guidance for any additional hardening measures or configuration changes.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the CVE IDs for the PHP2shell vulnerabilities?
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
Who discovered these security flaws in PHP?
Researchers at Calif, OpenAI, and Wiz found the holes between August and September using AI models.
Why was the disclosure moved up from Thursday to Wednesday?
PHP maintainers moved the date because CVE IDs and incorrect details began circulating online on Tuesday.
