Two PHP flaws rated 9.2 landed on October 21, and the fixed versions are easy to name. The harder question is whether you can prove which binary is answering requests on every vhost, staging box and forgotten container r…
Laravel 13.38.0 adds a session-based two-second fallback to the write connection after a database write and introduces DB::usingWritePdo() for relationship queries that need fresh data. The release accepts floats in Rule…
An October Medium report attributes two alleged critical PHP vulnerabilities, CVE-2026–109618 and CVE-2026–109619, to research involving Wiz and OpenAI’s GPT-5.6 Sol. It claims a 9.2 severity score, unauthenticated remot…
OpenAI has released a checker for Codex that tests whether a website publicly reveals a PHP version within the affected range. The phpcheck-url skill works from a URL, and phpcheck-server validates the local installation…
PHP’s emergency fixes on October 21, 2026 address CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote-code-execution flaws rated CVSS 9.2. A community Wazuh deployment uses process sampling and file-integrity…
Kevin Lopez has raised two semantic issues in the draft PHP Pattern Matching RFC. Array patterns should distinguish a missing key from an explicit null and use array_key_exists(). Integer patterns and numeric ranges shou…
OpenAI, Google and other AI labs are using frontier models to locate PHP vulnerabilities, build exploits and check proposed fixes. The current crisis involves structural flaws that may enable unauthenticated remote code …
A Reddit post is framed as a response from within the PHP security team to circulating PHP2Shell claims. The available excerpt names no disputed statements and no affected PHP versions. It cites no CVE and no exploit evi…
OffSeq’s research examines PHP2Shell activity during the first 48 hours recorded by its Mirage honeypot fleet. The company says PHP2Shell had leaked before a patch was available. Its first exploit-shaped request arrived …
Updated setup-php builds now include fixes for CVE-2026-109618 and CVE-2026-109619 across PHP 5.3 through 8.7. The builds target Linux, macOS and Windows, and include security backports for end-of-life PHP branches used …
Petecooper has apologized on Hacker News for an earlier post about the expected PHP RCE disclosures CVE-2026-109618 and CVE-2026-109619. The author says they did not know an embargo existed because two contacts had passe…
New details on PHP2Shell identify CVE-2026-109618 and CVE-2026-109619 as critical PHP runtime flaws rated 9.2 by the PHP security team. The scheduled fixes cover 8.2 through 8.5 only. PHP 8.1 and older remain unsupported…
Two 9.2-rated engine bugs, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, hit servers whose application code was spotless. Kai argues the fix is cultural: application teams should pin and ship the interpreter the way th…
This Medium article adds no new vulnerability details beyond PHP’s October 21 advisory and the fixed releases already covered. Its practical guidance is to verify the PHP runtime serving a site, including PHP-FPM or Apac…
Composer 2.11.0-RC1 is available for testing ahead of the stable release. The pre-release removes the temporary source-fallback option and adds a configurable cooldown for new packages. It hardens TLS and bin proxy gener…
An article by Elias Taylor dated October 21, 2026 argues that the newly discussed PHP vulnerability has no reliable exploit against an unmodified PHP installation. Taylor says thousands of GitHub PoCs depend on extra ser…
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619. The flaws affect web-facing SAPIs and can enable unauthenticated remote code execution, with mod_php considered the highest-risk deployment. …
New reporting on php2shell shows the operational impact: organizations in several countries took government and institutional sites offline after BSI and CISA urged immediate action. Cloudflare counted millions of exploi…
Amazon Web Services detected an attempt to exploit PHP2Shell on October 17, four days before fixes for two PHP vulnerabilities and public reports appeared. The traffic reached an AWS honeypot from an IP tied to a commerc…
Amazon Linux 2023 assigns CVE-2026-109618 and CVE-2026-109619 the status Important, although PHP and other public assessments give both a CVSS v4.0 score of 9.2 and Critical severity. AWS says PHP 8.2 through 8.5 are aff…
PHP's October 21, 2026 security release fixes two critical RCE vulnerabilities, but a new analysis shifts attention to response capability. It covers the patched branches and the SAPI-specific exposure for each flaw, the…
PHP is set to publish an emergency security update on 21 October 2026 at 14:00 UTC for two critical vulnerabilities rated CVSS v4.0 9.2. CERT-EU lists CVE-2026-109618 and CVE-2026-109619 and warns of possible remote code…
On October 21, 2026, PHP released emergency fixes for CVE-2026–109618 and CVE-2026–109619, two critical unauthenticated remote-code-execution flaws rated 9.2 by CVSS v4.0. Fixed branches are PHP 8.5.12, 8.4.27, 8.3.36, a…
FrankenPHP 1.13.2, released on 21 October, is a security update for the PHP application server. Its Docker images and static binaries include PHP versions that address PHP2Shell, two critical flaws enabling unauthenticat…
The Dutch National Cyber Security Centre (NCSC) has taken NCSC.NL offline as a precaution, citing vulnerabilities in PHP. The agency says PHP’s security team expects to publish a patch at 16:00 Dutch time and plans an ad…
An October 21 post describes a reportedly separate PHP vulnerability that produces an AddressSanitizer double-free error in PHP 8.4.25. The author says the behavior was confirmed on PHP 8.5.10 and still worked on 8.5.12.…
A post on r/PHP asks why CloudLinux is listing patches for PHP 7.4 and 8.0 before updates for 8.2 through 8.5. The discussion concerns CVE-2026-109618 and CVE-2026-109619. The author says official PHP security releases b…
Calif Research has published a technical account of CVE-2026-109618 and CVE-2026-109619, which were fixed in PHP’s October 21, 2026 security release. The report, produced with contributions from OpenAI and Wiz, explains …
The PHP project has released new point versions for four branches: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. The release notices provide no changelog or security details.
Laravel published framework v12.70.1 on 21 October as a focused patch for the 12.x branch. The release contains one commit, e09fc54, from pull request #62027 by @valorin. Its change prevents escaping from bypassing prote…
