{ "checked_on": "2026-10-21", "scope": "Verified original research, advisories, provider updates and agency statements. This is an editorial source index, not an exhaustive record of every public post.", "publishers": [ { "id": "php", "name": "PHP project", "kind": "company", "role": "Release advisory", "date": "2026-10-21", "url": "https://www.php.net/archive/2026.php#2026-10-21-5", "description": "Emergency PHP releases and the original security advisory.", "full_summary": "PHP released emergency fixes for two critical remote code execution flaws and urges operators to update immediately.", "logo": "/assets/logos/php.svg", "logo_class": "" }, { "id": "wiz", "name": "Wiz", "kind": "company", "role": "Original research", "date": "2026-10-21", "url": "https://www.wiz.io/blog/php2shell-php-rce", "description": "Original research into the PHP runtime flaws and attack paths.", "full_summary": "Wiz reports its research into PHP2Shell and controlled unauthenticated code execution demonstrations on WordPress, Drupal and Joomla container deployments.", "logo": "/assets/logos/wiz.svg", "logo_class": "" }, { "id": "openai", "name": "OpenAI", "kind": "company", "role": "Coordinated disclosure", "date": "2026-10-21", "url": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/", "description": "Coordinated disclosure with PHP maintainers, researchers and providers.", "full_summary": "OpenAI describes coordinating research and defensive preparations with PHP maintainers and partners and directs operators to apply the PHP fixes.", "logo": "/assets/logos/openai-optical.svg", "logo_class": "" }, { "id": "cloudflare", "name": "Cloudflare", "kind": "company", "role": "Protection update", "date": "2026-10-21", "url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection", "description": "WAF response, observed attack traffic and PHP patching guidance.", "full_summary": "Cloudflare says it deployed PHP2Shell WAF protections and observed attack traffic, while emphasizing that operators still need the PHP update.", "logo": "/assets/logos/cloudflare-optical.svg", "logo_class": "" }, { "id": "cisa", "name": "CISA", "kind": "government", "role": "Government alert", "date": "2026-10-21", "url": "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching", "description": "Calls for immediate PHP patching and taking affected systems offline when they cannot be updated.", "full_summary": "CISA’s October 21 alert covers PHP2Shell, CVE-2026-109618 and CVE-2026-109619. It urges PHP inventory, immediate updates prioritizing internet-facing systems, and monitoring for suspicious PHP worker activity. Systems that cannot be updated, including unsupported PHP 8.1 and earlier, should be taken offline until updated. CISA states it had not observed exploitation at publication.", "logo": "/assets/logos/cisa.png", "logo_class": "" }, { "id": "fbi", "name": "FBI Cyber Division", "kind": "government", "role": "Federal warning", "date": "2026-10-21", "url": "https://x.com/FBICyberDiv/status/2112921648252719420", "description": "Urges immediate PHP updates or taking unmitigated systems offline.", "full_summary": "The FBI Cyber Division’s official 21 October warning names CVE-2026-109618 and CVE-2026-109619. It urges immediate PHP updates, taking systems offline if the risk cannot be mitigated, inventorying PHP deployments and monitoring for suspicious activity. For suspected compromise, it recommends isolating affected systems, preserving logs and reporting to the FBI.", "logo": "/assets/logos/fbi.png", "logo_class": "" }, { "id": "cert-eu", "name": "CERT-EU", "kind": "government", "role": "Government advisory", "date": "2026-10-21", "url": "https://cert.europa.eu/publications/security-advisories/2026-018/", "description": "Security Advisory 2026-018: critical PHP vulnerabilities.", "full_summary": "Original advisory page confirms title and publication date; history lists initial v1.0 and additional-information v1.1 on 21 October.", "logo": "/assets/logos/cert-eu.svg", "logo_class": "is-dark" }, { "id": "ncsc-nl", "name": "NCSC Netherlands", "kind": "government", "role": "Government advisory", "date": "2026-10-21", "url": "https://advisories.ncsc.nl/2026/ncsc-2026-0443.html", "description": "Urgent Dutch guidance on the two critical PHP flaws.", "full_summary": "Advisory names both CVEs, describes out-of-memory corruption and stale global state, and urges immediate application of PHP security updates.", "logo": "/assets/logos/ncsc-nl.svg", "logo_class": "is-ribbon" }, { "id": "ncsc-uk", "name": "NCSC United Kingdom", "kind": "government", "role": "Government alert", "date": "2026-10-21", "url": "https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php", "description": "Calls for immediate updates and mitigation of PHP systems.", "full_summary": "Encourages immediate updating of PHP systems; where immediate remediation is infeasible, organisations should consider taking the system offline until fully mitigated. Recommends inventorying PHP, monitoring for malicious activity, and applying updates.", "logo": "/assets/logos/ncsc-uk.svg", "logo_class": "" }, { "id": "drupal", "name": "Drupal Security Team", "kind": "company", "role": "Project advisory", "date": "2026-10-21", "url": "https://www.drupal.org/psa-2026-10-20", "description": "The Drupal Security Team’s own PHP security announcement.", "full_summary": "Drupal's Security Team tells site operators to reserve time for the critical PHP update and says a patched PHP release is the only complete mitigation.", "logo": "/assets/logos/drupal.png", "logo_class": "" }, { "id": "aikido", "name": "Aikido Security", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell", "description": "An alert on PHP2Shell and coordinated patch preparations.", "full_summary": "Aikido publishes a PHP2Shell alert and describes working with PHP and the security community on patch preparations.", "logo": "/assets/logos/aikido.svg", "logo_class": "" }, { "id": "almalinux", "name": "AlmaLinux", "kind": "company", "role": "Distribution update", "date": "2026-10-21", "url": "https://almalinux.org/ko/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/", "description": "Backported PHP fixes and updated AlmaLinux packages.", "full_summary": "AlmaLinux reports backporting the PHP2Shell fixes and building updated packages for AlmaLinux 8, 9 and 10.", "logo": "/assets/logos/almalinux.png", "logo_class": "" }, { "id": "automattic", "name": "Automattic", "kind": "company", "role": "Hosting response", "date": "2026-10-21", "url": "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "description": "A protection update for its hosting platforms and PHP guidance.", "full_summary": "Automattic says sites on its named hosting platforms are protected and instructs operators managing their own PHP to update the runtime.", "logo": "/assets/logos/automattic.png", "logo_class": "" }, { "id": "bitsight", "name": "Bitsight", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2026-109618-and-cve-2026-109619-php2shell", "description": "An exposure assessment and PHP vulnerability alert.", "full_summary": "Bitsight publishes a PHP2Shell vulnerability alert with its own internet-exposure observations and advice to prepare runtime updates.", "logo": "/assets/logos/bitsight.svg", "logo_class": "" }, { "id": "ubuntu", "name": "Canonical / Ubuntu", "kind": "company", "role": "Distribution update", "date": "2026-10-21", "url": "https://ubuntu.com/blog/php2shell-vulnerability-fixes-available", "description": "Canonical’s PHP package fixes for supported Ubuntu releases.", "full_summary": "Ubuntu says it has released fixes for affected PHP packages across all supported Ubuntu releases.", "logo": "/assets/logos/ubuntu.svg", "logo_class": "is-dark is-compact" }, { "id": "cisco-talos", "name": "Cisco Talos", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://blog.talosintelligence.com/two-critical-rces-in-php-core/", "description": "PHP update guidance and Snort detection coverage.", "full_summary": "Cisco Talos urges PHP users to install the fixed releases and publishes Snort coverage and interim risk-reduction guidance.", "logo": "/assets/logos/cisco-talos.svg", "logo_class": "" }, { "id": "corelight", "name": "Corelight", "kind": "company", "role": "Detection release", "date": "2026-10-21", "url": "https://corelight.com/blog/php2shell-detection-before-disclosure", "description": "Open-source Zeek and Suricata detections for defenders.", "full_summary": "Corelight released open-source Zeek and Suricata detections developed as part of the coordinated PHP2Shell response.", "logo": "/assets/logos/corelight.png", "logo_class": "" }, { "id": "crowdstrike", "name": "CrowdStrike", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/", "description": "Detection and visibility guidance for the PHP vulnerabilities.", "full_summary": "CrowdStrike describes the PHP2Shell vulnerabilities and the Falcon platform's visibility and detection for post-exploitation activity.", "logo": "/assets/logos/crowdstrike.svg", "logo_class": "" }, { "id": "dreamhost", "name": "DreamHost", "kind": "company", "role": "Hosting response", "date": "2026-10-21", "url": "https://www.dreamhoststatus.com/", "description": "A dated hosting response update on PHP2Shell protections.", "full_summary": "DreamHost reports implementing protections across its hosting platforms and preparing to deploy patched PHP builds.", "logo": "/assets/logos/dreamhost.svg", "logo_class": "" }, { "id": "endor-labs", "name": "Endor Labs", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619", "description": "Guidance to find affected PHP deployments and update.", "full_summary": "Endor Labs urges organizations to identify affected PHP deployments and update the runtime immediately.", "logo": "/assets/logos/endor-labs.svg", "logo_class": "" }, { "id": "huntress", "name": "Huntress", "kind": "company", "role": "Research & advisory", "date": "2026-10-20", "url": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "description": "Early guidance on inventory, patch preparation and monitoring.", "full_summary": "Huntress advises operators to inventory PHP installations, prepare to patch and monitor for suspicious PHP child processes.", "logo": "/assets/logos/huntress.svg", "logo_class": "" }, { "id": "imperva", "name": "Imperva", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://www.imperva.com/blog/php2shell-vulnerability-updates/", "description": "Analysis of the PHP flaws and defensive guidance.", "full_summary": "Imperva analyzes the PHP runtime memory-safety flaws and advises organizations to apply vendor-provided fixes promptly.", "logo": "/assets/logos/imperva.svg", "logo_class": "" }, { "id": "mijndomein", "name": "Mijndomein", "kind": "company", "role": "Hosting response", "date": "2026-10-21", "url": "https://mijndomein.zendesk.com/hc/nl/articles/40010485409170-MijnAccount-Mijndomein-Webhosting-Webmail-offline-PHP-kwetsbaarheden-CVE-2026-109618-CVE-2026-109619", "description": "A first-party notice of precautionary service shutdowns.", "full_summary": "Mijndomein says it decided at 13:35 to take websites and services offline preventively until PHP and supplier updates could be applied.", "logo": "/assets/logos/mijndomein.png", "logo_class": "" }, { "id": "namecheap", "name": "Namecheap", "kind": "company", "role": "Hosting response", "date": "2026-10-21", "url": "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "description": "A hosting status notice on deploying patched PHP versions.", "full_summary": "Namecheap publishes a PHP2Shell hosting status notice and says it is installing patched PHP versions across its platform.", "logo": "/assets/logos/namecheap.png", "logo_class": "is-compact" }, { "id": "palo-alto-networks", "name": "Palo Alto Networks / Unit 42", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/", "description": "Unit 42 threat assessment and patching recommendations.", "full_summary": "Unit 42 recommends assessing PHP exposure and patching immediately and describes Palo Alto Networks detection and prevention coverage.", "logo": "/assets/logos/palo-alto-networks.svg", "logo_class": "" }, { "id": "patchstack", "name": "Patchstack", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/", "description": "A runtime security alert for PHP website operators.", "full_summary": "Patchstack alerts PHP application operators to the critical runtime flaws and says updating PHP is the confirmed fix.", "logo": "/assets/logos/patchstack.svg", "logo_class": "" }, { "id": "sansec", "name": "Sansec", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://sansec.io/research/php2shell", "description": "Why the fix belongs at the PHP runtime and hosting layer.", "full_summary": "Sansec warns that PHP2Shell requires a PHP runtime update at the infrastructure or hosting-provider level rather than a store-code change.", "logo": "/assets/logos/sansec.svg", "logo_class": "" }, { "id": "sonatype", "name": "Sonatype", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://www.sonatype.com/blog/php2shell-makes-php-inventory-and-patch-ownership-urgent", "description": "Why PHP inventory and clear patch ownership matter.", "full_summary": "Sonatype's research team calls for PHP inventory, clear patch ownership and immediate remediation of exposed systems.", "logo": "/assets/logos/sonatype.svg", "logo_class": "is-compact" }, { "id": "tenable", "name": "Tenable", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "description": "A technical FAQ covering the emergency PHP release.", "full_summary": "Tenable publishes a PHP2Shell FAQ covering the emergency release, exposure and product coverage.", "logo": "/assets/logos/tenable.svg", "logo_class": "" }, { "id": "php-foundation", "name": "The PHP Foundation", "kind": "company", "role": "Maintainer response", "date": "2026-10-21", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "description": "How PHP’s maintainers coordinated fixes and the emergency release.", "full_summary": "The PHP Foundation explains the discovery, fixes and coordinated response, and urges operators to apply the released PHP updates.", "logo": "/assets/logos/php-foundation.svg", "logo_class": "is-compact" }, { "id": "tryhackme", "name": "TryHackMe", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://tryhackme.com/resources/blog/php2shell-update", "description": "A threat alert distinguishing verified facts from exploit claims.", "full_summary": "TryHackMe publishes a threat alert distinguishing confirmed PHP release information from unverified exploit claims and incomplete workarounds.", "logo": "/assets/logos/tryhackme.svg", "logo_class": "is-dark" }, { "id": "watchtowr", "name": "watchTowr", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "description": "Research updates, reproduction and PHP patch guidance.", "full_summary": "watchTowr confirms the PHP2Shell flaws, reports exploitation attempts and points operators to the patched PHP versions.", "logo": "/assets/logos/watchtowr.svg", "logo_class": "" }, { "id": "zafran", "name": "Zafran", "kind": "company", "role": "Research & advisory", "date": "2026-10-21", "url": "https://www.zafran.io/resources/php2shell-everything-you-need-to-know-about-the-two-critical-php-vulnerabilities", "description": "A research overview of the flaws and emergency update schedule.", "full_summary": "Zafran's research team publishes a PHP2Shell advisory describing the critical PHP runtime flaws and the emergency update schedule.", "logo": "/assets/logos/zafran.svg", "logo_class": "" }, { "id": "acsc", "name": "ASD’s ACSC", "kind": "government", "role": "Government alert", "date": "2026-10-21", "url": "https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php", "description": "Australia’s alert on critical PHP vulnerabilities.", "full_summary": "Warns of the planned PHP release, names both CVEs based on reporting, and recommends identifying PHP, preparing updates, and monitoring. States ACSC was not aware of active exploitation at publication.", "logo": "/assets/logos/acsc.jpg", "logo_class": "" }, { "id": "bsi", "name": "BSI Germany", "kind": "government", "role": "Government warning", "date": "2026-10-21", "url": "https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2026/261021_PHP-kritische-Schwachstelle.html", "description": "Urged security updates for critical PHP vulnerabilities.", "full_summary": "Official release explicitly displays 21.10.2026 and urges preparation for urgent security updates to PHP. It links the agency’s detailed security warning. The official BSI LinkedIn post links this exact press release via bsi.bund.de/dok/1211260.", "logo": "/assets/logos/bsi.svg", "logo_class": "" }, { "id": "canada-cyber-centre", "name": "Canadian Cyber Centre", "kind": "government", "role": "Government bulletin", "date": "2026-10-21", "url": "https://www.cyber.gc.ca/fr/alertes-avis/bulletin-securite-php-av26-1070", "description": "Security bulletin AV26-1070 on PHP updates.", "full_summary": "Official bulletin AV26-1070 dates itself 21 October 2026 and encourages users and administrators to review linked PHP guidance and install necessary updates as they become available.", "logo": "/assets/logos/canada-cyber-centre.png", "logo_class": "" }, { "id": "cert-pl", "name": "CERT Polska", "kind": "government", "role": "Government warning", "date": "2026-10-21", "url": "https://moje.cert.pl/komunikaty/2026/196/krytyczne-podatnosci-w-php-umozliwiajace-zdalne-wykonanie-kodu-php2shell/", "description": "Warning 196/2026 on PHP remote code execution.", "full_summary": "Official warning 196/2026 names both CVEs, explains remote command execution from memory-management errors, and says installing the corrected PHP version is the effective protection.", "logo": "/assets/logos/cert-pl.svg", "logo_class": "is-dark" }, { "id": "cert-fr", "name": "CERT-FR / ANSSI", "kind": "government", "role": "Government alert", "date": "2026-10-21", "url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/", "description": "France’s national alert on multiple PHP vulnerabilities.", "full_summary": "CERT-FR official current-alert index lists the PHP alert and its 21 October publication; original alert's indexed documentation names both CVEs and PHP/CERT-EU announcements.", "logo": "/assets/logos/cert-fr.svg", "logo_class": "is-wide" }, { "id": "rechtspraak", "name": "Dutch judiciary", "kind": "government", "role": "Public statement", "date": "2026-10-21", "url": "https://www.rechtspraak.nl/organisatie-en-contact/organisatie/raad-voor-de-rechtspraak/nieuws/2026/10/enkele-rechtspraak-websites-vanwege-php-kwetsbaarheid-tijdelijk-offline", "description": "Announced two websites taken offline as a precaution.", "full_summary": "Official judiciary announcement says Werkenbijderechtspraak.nl and SSR.nl (MijnSSR) were taken offline as a precaution because those websites use PHP.", "logo": "/assets/logos/rechtspraak.svg", "logo_class": "" }, { "id": "govcert-hk", "name": "GovCERT.HK", "kind": "government", "role": "Government alert", "date": "2026-10-21", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2125", "description": "High-threat security alert A26-10-36.", "full_summary": "Official high-threat alert identifies both CVEs and states reports indicate a high risk of exploitation.", "logo": "/assets/logos/govcert-hk.png", "logo_class": "is-wide" }, { "id": "ipa-japan", "name": "IPA Japan", "kind": "government", "role": "Government notice", "date": "2026-10-21", "url": "https://www.ipa.go.jp/security/security-alert/2026/pre-alert20261021.html", "description": "Notice to prepare for PHP’s critical security release.", "full_summary": "Official IPA pre-alert notes the PHP security release scheduled at 23:00 Japan time and identifies the two CVEs via CERT-EU’s warning.", "logo": "/assets/logos/ipa-japan.svg", "logo_class": "" }, { "id": "nhs-england", "name": "NHS England", "kind": "government", "role": "Public-sector alert", "date": "2026-10-21", "url": "https://digital.nhs.uk/cyber-alerts/2026/cc-4875", "description": "Cyber Alert CC-4875 on the PHP2Shell vulnerabilities.", "full_summary": "Official alert CC-4875 names both CVEs and their 9.2 scores, describes the PHP runtime causes, and assesses future exploitation as highly likely. It calls on affected organisations to review PHP’s 21 October guidance and complete remediation.", "logo": "/assets/logos/nhs-england.jpg", "logo_class": "" }, { "id": "nsa", "name": "NSA Cyber", "kind": "government", "role": "Government warning", "date": "2026-10-21", "url": "https://x.com/NSACyber/status/2112903220209098897", "description": "Urges PHP updates or taking unmitigated systems offline.", "full_summary": "The official NSA Cyber warning calls on organizations using PHP to prepare for the critical security update. When an immediate update is not feasible, it recommends taking the system offline until the risk can be fully mitigated.", "logo": "/assets/logos/nsa.jpg", "logo_class": "" }, { "id": "govcert-cz", "name": "GovCERT.CZ", "kind": "government", "role": "Government warning", "date": "2026-10-21", "url": "https://x.com/GOVCERT_CZ/status/2112871844424393191", "description": "Czech national warning about both critical PHP2Shell flaws.", "full_summary": "GovCERT.CZ identifies CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2, and warns that the PHP core vulnerabilities can allow remote code execution. This is a warning about PHP2Shell, not a separate incident or evidence of compromise at the agency.", "logo": "/assets/logos/govcert-cz.jpg", "logo_class": "" }, { "id": "laravel", "name": "Laravel", "kind": "company", "role": "Platform response", "date": "2026-10-21", "url": "https://x.com/laravel/status/2112873542346031513", "description": "Cloud, Forge and Vapor instructions for the PHP security release.", "full_summary": "Laravel announces automatic patching for Cloud applications and automatic redeployment of Vapor applications on PHP 8 after the PHP patch is released. Forge customers are told to update their server PHP version manually; Vapor PHP 7 applications are told to move to PHP 8. These are the instructions at publication, not a current status check of every customer.", "logo": "/assets/logos/laravel.svg", "logo_class": "" }, { "id": "obs", "name": "OBS Project", "kind": "company", "role": "Service notice", "date": "2026-10-21", "url": "https://x.com/OBSProject/status/2112782086956540044", "description": "Announced partial website downtime ahead of the PHP disclosure.", "full_summary": "OBS says parts of its website will be unavailable while it awaits disclosure of a PHP vulnerability. The notice says streaming through connected accounts should not be affected. It is a precautionary service notice and does not report a breach. Publication date is recorded in UTC.", "logo": "/assets/logos/obs.png", "logo_class": "" }, { "id": "anilist", "name": "AniList", "kind": "company", "role": "Service notice", "date": "2026-10-21", "url": "https://x.com/AniListco/status/2112887683152322632", "description": "Announced a precautionary website and API shutdown pending a fix.", "full_summary": "AniList links the PHP Foundation security-release notice and announces that it will take its site and API offline until it can confirm a fix. The original post gives no firm restoration time. This is a precautionary shutdown announcement, not confirmation of compromise or a statement that services remain offline now.", "logo": "/assets/logos/anilist.png", "logo_class": "" } ] }