Skip to content
EVENT / TOPICHistorical

PHP 8.5.12 and other versions released to fix PHP2Shell vulnerability

2 reports2 sources10/22/2026 updated

Current overview (not historical)

AI overview

PHP Foundation discovered signs of an OOM vulnerability (CVE-2026-109618) in 2024 but delayed the fix due to decision-making processes and resource shortages, which was criticized as a 'structural mistake'. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on October 23, 2024 to patch the flaw, though the official stance notes 'no complete mitigation,' making updates the only secure option. Versions 8.1 and earlier are no longer officially supported, leaving outdated servers as a weak point.

Written with AI from the reporting · updated 10/22/2026

Latest developmentOct 23, 06:21
PHP releases fixes for PHP2Shell vulnerability but manual installation is required
Explore the timeline, relations and evidence
Expand the detailed fact route and sources

Story route

A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.

  1. 1Unclassified fact stationOct 23, 00:00recorded Oct 23, 06:56single sourcerevised

    PHP 8.5.12等版本发布修复 PHP2Shell 漏洞

    Read original source ↗ DecryptReplay this moment in the explorer
    Evidence & revisions · 1 source records
    Subject：
    PHP Foundation
    Action：
    发布安全更新
    Object：
    PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 等版本
    Occurred (fact side)：
    Oct 23, 00:00
    Decrypt ↗Report pageRevision 2 · currently revised
    Published (valid side)：
    Oct 23, 06:21
    First seen (known side)：
    Oct 23, 06:56
    Fact stationSingle source · one-sided claimRevised

    Copy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.

Uncertainty marks flag where to check the sources; they are not proven causation.

Report timeline

Explore every side through dated source reports.

Oct 23
  1. DecryptRelated fact: single sourceSource report revised
    PHP releases fixes for PHP2Shell vulnerability but manual installation is required

    Report first recorded Oct 23, 06:56

    PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address PHP2Shell, a flaw allowing unauthorized server control on about 70% of websites. However, the fix requires manual installation and PHP restart by every hosting company or website owner; it does not apply automatically. Cloudflare CEO Matthew Prince said exploit attempts have climbed into the millions, though Germany's BSI and Japan's government have not confirmed any successful break-ins. PHP Foundation called the delay in fixing the flaw a "structural failure."

    Read original source ↗
Oct 22
  1. Latent Space
    OpenAI's Patch the Planet and Wiz discover PHP2Shell vulnerabilities affecting 70% of web

    Report first recorded Oct 22, 16:20

    Two parties, Ryan Austin from Calif (as part of OpenAI's "Patch the Planet" project using GPT-5.6 Sol) and Wiz (using Gemini 4 Argon and GPT-5.6 Sol), independently discovered two PHP-engine memory-corruption vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), almost two months ago. These defects are in PHP's internal handling of out-of-memory conditions and fatal errors, not in CMS plugins, and demonstrations showed pre-authentication RCE against WordPress, Drupal, and Joomla, potentially affecting 70% of the web through a coordinated ecosystem response.

    Read original source ↗

Event discussion

Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.

Open GitHub Discussions