Critical PHP flaws allow unauthenticated server takeover; PHP issues emergency patches on Oct 21 — all PHP sites must upgrade now
PHP officially released emergency versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619, dubbed PHP2Shell) that let attackers run arbitrary code on a server with a specially crafted request — no login required. An estimated 70% of websites run PHP, including WordPress, Drupal and Magento; OpenAI says security firm Calif found the flaws using GPT-5.6 Sol under its Patch the Planet initiative. This matters because the flaw is in the PHP engine itself, so no site-level hardening helps — the official line is that upgrading is the only complete fix.
SOURCES
- 宝玉 (Baoyu)2026-10-21 15:50
- OpenAI2026-10-21 14:04
- IT之家2026-10-21 08:00
- LinuxDo2026-10-21 03:00
- IT之家2026-10-21 13:23