https://phpvulnerabilities.app/ Unofficial briefing updates on PHP security vulnerabilities. Not php.net, NVD, or CISA. en Thu, 22 Oct 2026 00:00:00 GMT https://phpvulnerabilities.app/ https://phpvulnerabilities.app/ Thu, 22 Oct 2026 00:00:00 GMT PHP 8.2, 8.3, 8.4, and 8.5 are affected by CVE-2026-109618 and CVE-2026-109619 until you install 8.2.35, 8.3.36, 8.4.27, or 8.5.12. Those four releases, shipped on 21 October 2026, are the only complete upstream fix the PHP project describes, and the workers must be restarted afterward. PHP 8.1 and older did not get an official release, and the sources disagree on how far back the bugs reach. https://phpvulnerabilities.app/php2shell/ https://phpvulnerabilities.app/php2shell/ Thu, 22 Oct 2026 00:00:00 GMT PHP2Shell is the public name for two critical bugs in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, not a flaw in one web application. The PHP project says an unauthenticated request can lead to remote code execution on installations that serve web traffic, and it calls Apache mod_php the highest risk. Updating to the 21 October 2026 releases is the only complete fix those sources describe. https://phpvulnerabilities.app/cve/CVE-2026-109618/ https://phpvulnerabilities.app/cve/CVE-2026-109618/ Thu, 22 Oct 2026 00:00:00 GMT CVE-2026-109618 is a critical PHP bug, scored CVSS v4.0 9.2 by the PHP security team, in which out-of-memory handling can corrupt request state and lead to remote code execution. The team lists PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. The 21 October 2026 releases that fix CVE-2026-109619 also fix this CVE. https://phpvulnerabilities.app/cve/CVE-2026-109619/ https://phpvulnerabilities.app/cve/CVE-2026-109619/ Thu, 22 Oct 2026 00:00:00 GMT CVE-2026-109619 is a critical PHP bug, scored CVSS v4.0 9.2 by the PHP security team, in which request-owned state can survive after its memory is freed and be reused by a later request on the same worker. Supported branches are fixed by PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, released on 21 October 2026. Setting session.upload_progress.enabled to 0 is an incomplete bridge for one confirmed path, not a substitute for that upgrade. https://phpvulnerabilities.app/affected-versions/ https://phpvulnerabilities.app/affected-versions/ Thu, 22 Oct 2026 00:00:00 GMT Install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or any later release in the same branch, to close both CVEs with an official PHP package. PHP 8.1 and older have no new official release; minimal source backports were published only for 7.4, 8.0, and 8.1. Wiz, Google Cloud, and Cloudflare describe impact from PHP 5.4 upward, while Expel says PHP has not explicitly confirmed 7.3 and older. https://phpvulnerabilities.app/remediation/ https://phpvulnerabilities.app/remediation/ Thu, 22 Oct 2026 00:00:00 GMT Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, then restart the SAPI that actually serves the site. The PHP project, AWS, and CISA describe that upgrade as the only complete fix. Interim php.ini limits reduce specific paths and do not replace the new binary. https://phpvulnerabilities.app/faq/ https://phpvulnerabilities.app/faq/ Thu, 22 Oct 2026 00:00:00 GMT Upgrade supported PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart it. A firewall, and the interim settings PHP published, are not a complete fix. The answers below stay inside the public record and do not include exploit steps. https://phpvulnerabilities.app/timeline/ https://phpvulnerabilities.app/timeline/ Thu, 22 Oct 2026 00:00:00 GMT PHP shipped the fixes on 21 October 2026, after AWS described a honeypot attempt on 17 October and watchTowr discussed leaked details on 20 October. Government alerts that day told operators to patch. The embargo clocks are left as each source wrote them: ENISA at 13:40 UTC, CERT-EU at 13:30 UTC, and AWS and BSI at 14:00 UTC. https://phpvulnerabilities.app/about/ https://phpvulnerabilities.app/about/ Thu, 22 Oct 2026 00:00:00 GMT phpvulnerabilities.app is an independent briefing, not php.net, NVD, or CISA. It cites public sources and does not host exploit code. The date on each page is the last editorial pass, not a claim that every linked site was re-read that morning. https://phpvulnerabilities.app/privacy/ https://phpvulnerabilities.app/privacy/ Thu, 22 Oct 2026 00:00:00 GMT This static site does not run accounts, and the email field on the overview and contact pages does not send or store an address. That field is a placeholder with no backend. If AdSense is turned on later, its script waits for the consent banner; the Adsterra unit, when enabled, loads separately. https://phpvulnerabilities.app/contact/ https://phpvulnerabilities.app/contact/ Thu, 22 Oct 2026 00:00:00 GMT Editorial mail goes to contact@phpvulnerabilities.app, which is not the PHP security team. A correction needs the page URL and a primary source, and exploit code will not be published. The email box on this page is a placeholder and does not keep the address. https://phpvulnerabilities.app/assessments/ https://phpvulnerabilities.app/assessments/ Thu, 22 Oct 2026 00:00:00 GMT Authorities agree that operators should install the 21 October 2026 PHP updates. They do not agree on exploitation: CISA, the Canadian Cyber Centre, and Germany’s BSI said they had no confirmed in-the-wild exploitation when they published, while AWS, Cloudflare, and watchTowr report attempts. A secondary report said NVD was still analyzing CVE-2026-109618, and this site has not re-read the live NVD pages. https://phpvulnerabilities.app/vendor-status/ https://phpvulnerabilities.app/vendor-status/ Thu, 22 Oct 2026 00:00:00 GMT Ubuntu, cPanel, and Plesk have published builds they describe as fixed. Red Hat’s status is partly fixed, Cisco says it is still investigating and knows of no affected product, and Sophos says its products are not affected. As of 22 October 2026, the sources reviewed here do not include a public disclosure that a well-known site was compromised through PHP2Shell. https://phpvulnerabilities.app/php/8.5/ https://phpvulnerabilities.app/php/8.5/ Thu, 22 Oct 2026 00:00:00 GMT PHP 8.5 is vulnerable to both CVE-2026-109618 and CVE-2026-109619 before 8.5.12. PHP 8.5.12, published on 21 October 2026, is the upstream fix for this branch and closes both CVEs. Restart the SAPI that serves traffic after the upgrade. https://phpvulnerabilities.app/php/8.4/ https://phpvulnerabilities.app/php/8.4/ Thu, 22 Oct 2026 00:00:00 GMT PHP 8.4 is vulnerable to both CVE-2026-109618 and CVE-2026-109619 before 8.4.27. PHP 8.4.27, published on 21 October 2026, is the upstream fix for this branch and closes both CVEs. Restart the SAPI that serves traffic after the upgrade. https://phpvulnerabilities.app/php/8.3/ https://phpvulnerabilities.app/php/8.3/ Thu, 22 Oct 2026 00:00:00 GMT PHP 8.3 is vulnerable to both CVE-2026-109618 and CVE-2026-109619 before 8.3.36. PHP 8.3.36, published on 21 October 2026, is the upstream fix for this branch and closes both CVEs. Restart the SAPI that serves traffic after the upgrade. https://phpvulnerabilities.app/php/8.2/ https://phpvulnerabilities.app/php/8.2/ Thu, 22 Oct 2026 00:00:00 GMT PHP 8.2 is vulnerable to both CVE-2026-109618 and CVE-2026-109619 before 8.2.35. PHP 8.2.35, published on 21 October 2026, is the upstream fix for this branch and closes both CVEs. Restart the SAPI that serves traffic after the upgrade. https://phpvulnerabilities.app/php/eol/ https://phpvulnerabilities.app/php/eol/ Thu, 22 Oct 2026 00:00:00 GMT PHP 5 through 8.1 did not receive a new official release for these two CVEs on 21 October 2026. PHP published minimal source backports only for 7.4, 8.0, and 8.1, and those are not installable releases from php.net. Wiz, Google Cloud, and Cloudflare describe impact from 5.4 through the last pre-patch builds, while Expel says PHP has not explicitly confirmed 7.3 and older. https://phpvulnerabilities.app/bt-panel/ https://phpvulnerabilities.app/bt-panel/ Thu, 22 Oct 2026 00:00:00 GMT 宝塔’s notice, updated on 22 October 2026, says the Linux and Windows panels have synced PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. For Linux only, 宝塔 also ships packages numbered 7.4.34, 8.0.31, and 8.1.35 and says they include both fixes; those numbers are not PHP project releases. On Windows, PHP 8.1 and older is limited in that notice to the incomplete setting session.upload_progress.enabled=0. https://phpvulnerabilities.app/zh/ https://phpvulnerabilities.app/zh/ Thu, 22 Oct 2026 00:00:00 GMT PHP 8.2、8.3、8.4 和 8.5 在安装 8.2.35、8.3.36、8.4.27 或 8.5.12 之前，受 CVE-2026-109618 与 CVE-2026-109619 影响。这四个版本于 2026 年 10 月 21 日发布，是 PHP 项目所说的唯一完整上游修复，升级后必须重启实际对外服务的工作进程。PHP 8.1 及更早版本没有新的官方发行版，各来源对缺陷能回溯多远也不一致。 https://phpvulnerabilities.app/zh/php2shell/ https://phpvulnerabilities.app/zh/php2shell/ Thu, 22 Oct 2026 00:00:00 GMT PHP2Shell 是 PHP 运行时里两个严重缺陷的公开称呼，即 CVE-2026-109618 和 CVE-2026-109619，不是某一个 Web 应用的漏洞。PHP 项目称，对提供网页请求的安装，未经身份验证的请求可能导致远程代码执行，并把 Apache mod_php 列为最高风险。升级到 2026 年 10 月 21 日的发行版，是这些来源所说的唯一完整修复。 https://phpvulnerabilities.app/zh/cve/CVE-2026-109618/ https://phpvulnerabilities.app/zh/cve/CVE-2026-109618/ Thu, 22 Oct 2026 00:00:00 GMT CVE-2026-109618 是 PHP 中的严重缺陷，PHP 安全团队给出的 CVSS v4.0、分数 9.2，内存耗尽处理可能破坏请求状态并导致远程代码执行。该团队列出的范围是 8.2.35 之前的 8.2、8.3.36 之前的 8.3、8.4.27 之前的 8.4，以及 8.5.12 之前的 8.5。2026 年 10 月 21 日同时修复 CVE-2026-109619 的那些发行版，也修复这个 CVE。 https://phpvulnerabilities.app/zh/cve/CVE-2026-109619/ https://phpvulnerabilities.app/zh/cve/CVE-2026-109619/ Thu, 22 Oct 2026 00:00:00 GMT CVE-2026-109619 是 PHP 中的严重缺陷，PHP 安全团队给出的 CVSS v4.0、分数 9.2，请求持有的状态可能在内存释放后仍被同一工作进程上的后续请求使用。受支持分支的修复版本是 2026 年 10 月 21 日发布的 PHP 8.2.35、8.3.36、8.4.27 和 8.5.12。把 session.upload_progress.enabled 设为 0 只是一条已确认路径上的不完整过渡，不能代替升级。 https://phpvulnerabilities.app/zh/affected-versions/ https://phpvulnerabilities.app/zh/affected-versions/ Thu, 22 Oct 2026 00:00:00 GMT 安装 PHP 8.5.12、8.4.27、8.3.36 或 8.2.35，或同一分支的后续版本，才能用官方 PHP 包同时关上两个 CVE。PHP 8.1 及更早版本没有新的官方发行版；最小源码回移植只提供给 7.4、8.0 和 8.1。Wiz、Google Cloud 和 Cloudflare 把影响描述为自 PHP 5.4 起，Expel 则称 PHP 没有明确确认 7.3 及更早版本。 https://phpvulnerabilities.app/zh/remediation/ https://phpvulnerabilities.app/zh/remediation/ Thu, 22 Oct 2026 00:00:00 GMT 升级到 PHP 8.5.12、8.4.27、8.3.36 或 8.2.35，然后重启真正对外服务的 SAPI。PHP 项目、AWS 和 CISA 都把这次升级称为唯一完整的修复。临时的 php.ini 限制只能收窄特定路径，不能代替新的二进制文件。 https://phpvulnerabilities.app/zh/faq/ https://phpvulnerabilities.app/zh/faq/ Thu, 22 Oct 2026 00:00:00 GMT 把仍受支持的 PHP 升级到 8.5.12、8.4.27、8.3.36 或 8.2.35，然后重启。防火墙，以及 PHP 公布的临时设置，都不是完整修复。下面的回答停在公开记录之内，不包含利用步骤。 https://phpvulnerabilities.app/zh/timeline/ https://phpvulnerabilities.app/zh/timeline/ Thu, 22 Oct 2026 00:00:00 GMT PHP 于 2026 年 10 月 21 日发布修复；在此之前，AWS 描述了 10 月 17 日的蜜罐尝试，watchTowr 在 10 月 20 日讨论了泄露的细节。当天的政府警报要求运营者修补。解禁时刻按各来源原文保留：ENISA 为 13:40 UTC，CERT-EU 为 13:30 UTC，AWS 与 BSI 为 14:00 UTC。 https://phpvulnerabilities.app/zh/about/ https://phpvulnerabilities.app/zh/about/ Thu, 22 Oct 2026 00:00:00 GMT phpvulnerabilities.app 是独立简报，不是 php.net、NVD 或 CISA。它引用公开来源，不托管利用代码。每页上的日期是最近一次编辑核对，并不是说当天早上重读了每一个外链。 https://phpvulnerabilities.app/zh/privacy/ https://phpvulnerabilities.app/zh/privacy/ Thu, 22 Oct 2026 00:00:00 GMT 这个静态网站没有账户系统，概览页和联系页上的邮箱栏不会发送或保存地址。那个栏是占位，后面没有后端。若以后打开 AdSense，其脚本会等同意条；Adsterra 单元在启用时单独加载。 https://phpvulnerabilities.app/zh/contact/ https://phpvulnerabilities.app/zh/contact/ Thu, 22 Oct 2026 00:00:00 GMT 编辑信件寄到 contact@phpvulnerabilities.app，那不是 PHP 安全团队。更正需要页面 URL 和原始来源，利用代码不会被发表。本页的邮箱栏是占位，不会留下地址。 https://phpvulnerabilities.app/zh/assessments/ https://phpvulnerabilities.app/zh/assessments/ Thu, 22 Oct 2026 00:00:00 GMT 各当局一致认为，运营者现在就应安装 2026 年 10 月 21 日的 PHP 更新。他们在利用问题上并不一致：CISA、加拿大网络安全中心和德国 BSI 在发布时表示没有已证实的在野利用，而 AWS、Cloudflare 和 watchTowr 报告的是尝试。一份二手报道称 NVD 仍在分析 CVE-2026-109618，本站没有重读 NVD 的实时页面。 https://phpvulnerabilities.app/zh/vendor-status/ https://phpvulnerabilities.app/zh/vendor-status/ Thu, 22 Oct 2026 00:00:00 GMT Ubuntu、cPanel 和 Plesk 已发布他们称为已修复的构建。Red Hat 的状态是部分修复，Cisco 称仍在调查且不知道有受影响的产品，Sophos 称其产品不受影响。截至 2026 年 10 月 22 日，这里核对过的来源中，没有知名站点经 PHP2Shell 被入侵的公开披露。 https://phpvulnerabilities.app/zh/php/8.5/ https://phpvulnerabilities.app/zh/php/8.5/ Thu, 22 Oct 2026 00:00:00 GMT PHP 8.5 在 8.5.12 之前对 CVE-2026-109618 和 CVE-2026-109619 都受影响。2026 年 10 月 21 日发布的 PHP 8.5.12 是这个分支的上游修复，并同时关上两个 CVE。升级之后请重启对外服务的 SAPI。 https://phpvulnerabilities.app/zh/php/8.4/ https://phpvulnerabilities.app/zh/php/8.4/ Thu, 22 Oct 2026 00:00:00 GMT PHP 8.4 在 8.4.27 之前对 CVE-2026-109618 和 CVE-2026-109619 都受影响。2026 年 10 月 21 日发布的 PHP 8.4.27 是这个分支的上游修复，并同时关上两个 CVE。升级之后请重启对外服务的 SAPI。 https://phpvulnerabilities.app/zh/php/8.3/ https://phpvulnerabilities.app/zh/php/8.3/ Thu, 22 Oct 2026 00:00:00 GMT PHP 8.3 在 8.3.36 之前对 CVE-2026-109618 和 CVE-2026-109619 都受影响。2026 年 10 月 21 日发布的 PHP 8.3.36 是这个分支的上游修复，并同时关上两个 CVE。升级之后请重启对外服务的 SAPI。 https://phpvulnerabilities.app/zh/php/8.2/ https://phpvulnerabilities.app/zh/php/8.2/ Thu, 22 Oct 2026 00:00:00 GMT PHP 8.2 在 8.2.35 之前对 CVE-2026-109618 和 CVE-2026-109619 都受影响。2026 年 10 月 21 日发布的 PHP 8.2.35 是这个分支的上游修复，并同时关上两个 CVE。升级之后请重启对外服务的 SAPI。 https://phpvulnerabilities.app/zh/php/eol/ https://phpvulnerabilities.app/zh/php/eol/ Thu, 22 Oct 2026 00:00:00 GMT PHP 5 到 8.1 在 2026 年 10 月 21 日没有为这两个 CVE 拿到新的官方发行版。PHP 只为 7.4、8.0 和 8.1 提供了最小源码回移植，那不是可以从 php.net 安装的发行版。Wiz、Google Cloud 和 Cloudflare 把影响描述为自 5.4 起到修补前的最后构建，Expel 则称 PHP 没有明确确认 7.3 及更早版本。 https://phpvulnerabilities.app/zh/bt-panel/ https://phpvulnerabilities.app/zh/bt-panel/ Thu, 22 Oct 2026 00:00:00 GMT 宝塔于 2026 年 10 月 22 日更新的公告称，Linux 与 Windows 面板已同步 PHP 8.2.35、8.3.36、8.4.27 和 8.5.12。仅 Linux 另有宝塔打包的 7.4.34、8.0.31 和 8.1.35，公告称其中包含两项修复；这些版本号不是 PHP 项目的发行版。Windows 上的 PHP 8.1 及更早版本，在该公告里只能先把 session.upload_progress.enabled 设为 0，而这并不完整。