{
    "format": "anawords-story/1",
    "docs": "https://anawords.com/data",
    "url": "https://anawords.com/story/php2shell-critical-php-flaws-cve-2026-109618-patch-now",
    "title": "Two critical PHP flaws let attackers run code on web servers; fixed versions are out and AI helped find them",
    "summary": "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the “PHP2Shell” bugs. Amazon saw an exploitation attempt four days before disclosure, and researchers say AI models helped find and test the flaws.",
    "section": "Safety & Trust",
    "type": "incident",
    "published": "2026-10-22T16:37:53+05:30",
    "updated": "2026-10-22T16:37:53+05:30",
    "version": 1,
    "author": {
        "name": "Mayank Sahu",
        "url": "https://anawords.com/author/mayank-sahu"
    },
    "how_checked": "Sources checked by AI; published under the editor’s standing approval. Not read line by line by a person before publication.",
    "ai_assisted": true,
    "research_note": "https://anawords.com/research/php2shell-critical-php-flaws-cve-2026-109618-patch-now",
    "labels": {
        "confirmed": {
            "name": "Confirmed",
            "meaning": "An official source says it: lab docs, pricing page, notice."
        },
        "reported": {
            "name": "Reported",
            "meaning": "Two or more independent, named outlets say it."
        },
        "claim": {
            "name": "Company claim",
            "meaning": "Only the company says it. Not checked by anyone else yet."
        },
        "unconfirmed": {
            "name": "Unconfirmed",
            "meaning": "One report only, shown with its source."
        },
        "unknown": {
            "name": "Not known",
            "meaning": "Not announced or not answered yet."
        }
    },
    "facts": [
        {
            "id": "f1",
            "text": "PHP released fixes on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619, which allow remote code execution.",
            "label": "reported",
            "label_name": "Reported",
            "key_fact": true,
            "sources": [
                1,
                2
            ],
            "outcome": null
        },
        {
            "id": "f2",
            "text": "Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.",
            "label": "reported",
            "label_name": "Reported",
            "key_fact": true,
            "sources": [
                1,
                2
            ],
            "outcome": null
        },
        {
            "id": "f3",
            "text": "Amazon recorded an exploitation attempt on 17 October, four days before disclosure.",
            "label": "reported",
            "label_name": "Reported",
            "key_fact": true,
            "sources": [
                1,
                2
            ],
            "outcome": null
        },
        {
            "id": "f4",
            "text": "Both flaws are rated CVSS v4.0 9.2.",
            "label": "unconfirmed",
            "label_name": "Unconfirmed",
            "key_fact": false,
            "sources": [
                2
            ],
            "outcome": null
        },
        {
            "id": "f5",
            "text": "The PHP Foundation credited Calif, OpenAI and Wiz; Calif and Wiz said they used AI models.",
            "label": "unconfirmed",
            "label_name": "Unconfirmed",
            "key_fact": false,
            "sources": [
                2
            ],
            "outcome": null
        },
        {
            "id": "f6",
            "text": "How the attacker obtained details before disclosure.",
            "label": "unknown",
            "label_name": "Not known",
            "key_fact": false,
            "sources": [],
            "outcome": null
        }
    ],
    "sources": [
        {
            "n": 1,
            "url": "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/",
            "title": "Help Net Security: PHP2Shell, critical PHP vulnerabilities patched, update now",
            "type": "outlet",
            "checked": "22 Oct 2026",
            "archive": {
                "url": "https://web.archive.org/web/20261022111010/https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/",
                "archived": "2026-10-22T16:40:10+05:30"
            },
            "original_gone": false
        },
        {
            "n": 2,
            "url": "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote",
            "title": "Tenable: PHP2Shell (CVE-2026-109618, CVE-2026-109619) FAQ",
            "type": "outlet",
            "checked": "22 Oct 2026",
            "archive": {
                "url": "https://web.archive.org/web/20261021163302/https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote",
                "archived": "2026-10-21T22:03:02+05:30"
            },
            "original_gone": false
        }
    ],
    "promises": [],
    "prices": [],
    "incidents": [
        {
            "company": "PHP project (open source)",
            "product": "PHP 5.4 to 8.5",
            "kind": "Security",
            "what": "Two critical remote code execution flaws (CVE-2026-109618, CVE-2026-109619) fixed on 21 October 2026; exploitation seen from 17 October. Researchers used AI models in finding them.",
            "started": null,
            "ended": null,
            "duration": null,
            "official_status_page": null,
            "source": "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/",
            "label": "Reported",
            "story": null
        }
    ],
    "image": {
        "url": "https://anawords.com/uploads/2026/10/php2shell-critical-php-flaws-cve-2026-109618-patch-now-16x9.webp",
        "kind": "illustration",
        "note": "Anawords illustration made by software from facts in the story. Not a photograph."
    },
    "changes": [
        {
            "version": 1,
            "date": "2026-10-22T16:37:53+05:30",
            "correction": false,
            "note": "First published. Research note published first. Sources checked by AI; approved for publication by the editor."
        }
    ],
    "license": {
        "facts_and_data": "Creative Commons Attribution 4.0 (CC BY 4.0)",
        "url": "https://creativecommons.org/licenses/by/4.0/",
        "article_text": "© Anawords. Quote with a link.",
        "attribution": "Anawords, https://anawords.com/story/php2shell-critical-php-flaws-cve-2026-109618-patch-now"
    }
}