Trusence Every claim has a source
Last updated 26 October 2026 Search Türkçe
Security

Two critical PHP flaws let attackers take over unpatched servers without a password

Patches arrived on October 21, but a separate unpatched flaw has since been disclosed, and confirmed attacks show the risk is real.

26 October 2026 1 min read
A cracked brick wall with a large brass key left in its lock, lit softly on a dark stone surface.
AI-generated illustration

Two remote code execution flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, let an attacker take over an unpatched PHP server over the internet without credentials. PHP underpins roughly 70% of websites, so the bugs reached platforms such as WordPress, Drupal, Joomla and MediaWiki. The PHP Foundation released patches on October 21 after giving large companies and hosts an embargoed head start, and several organisations took servers offline to patch. Researchers at Perplexity later confirmed successful in-the-wild exploitation against an Apache mod_php installation running PHP 8.4.26, with a shell command executing shortly after the payload. A separate unpatched flaw, CVE-2026-115560, was disclosed on Friday, with an interim mitigation of setting session.upload_progress.enabled to 0.

Why it matters

Because PHP runs a large share of the web, the flaws reach far beyond individual sites: any server left unpatched can be taken over by an outsider without credentials. Attacks have already been confirmed in the wild, so operators who have not applied the October 21 fixes remain exposed. A further unpatched vulnerability, CVE-2026-115560, means the risk is not fully resolved, and until it is patched the interim mitigation of setting session.upload_progress.enabled to 0 is the step operators can take now.

Series Critical PHP flaws

  1. 26 Oct Two critical PHP flaws let attackers take over unpatched servers without a password
  2. 25 Oct PHP2Shell flaws used in fast attack on European government, with wider scanning under way
  3. 25 Oct PHP Emergency Fixes Close Two Critical Remote Code Execution Flaws Already Under Attack
  4. 25 Oct AI Tools Speed Up Exploits of Long-Known PHP Flaws
  5. 23 Oct PHP publishes interim mitigation for unpatched remote code execution flaw
  6. 23 Oct IT teams scramble to patch critical PHP flaw as no large breaches are confirmed
The whole series · 14 stories →

Sources · 2

Checked against its sources before publishing · 26 October at 13:08