PHP 修复两个远程代码执行漏洞 PHP2Shell，影响 PHP 5.4 至 PHP 8

From Wikipedia, the free encyclopedia PHP2Shell CVE identifiers CVE-2026-109618 CVE-2026-109619 Date patched 21 October 2026; 0 days ago Discoverer - Wiz - OpenAI - Calif Affected software PHP versions 5–8 Website php2shell.com CVE-2026-109618 and CVE-2026-109619 are two vulnerabilities in PHP that allow remote code execution and are together known as PHP2Shell. The existence of the vulnerability was publicly announced on 20 October.[1] An emergency patch and details about the vulnerability was released on the following day.[2] The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project, and by the Israeli-American cloud security company Wiz, Inc.[3] According to Wiz, versions as early as PHP 5.4, all the way through to PHP 8, are affected.[4] Wikimedia's Phabricator instance as seen hours before the patch, having been disabled as a precaution The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers,[5] while security firm watchTowr rated it a full 10.0.[6] The maintainers of PHP worked with companies including Wiz, Cloudflare, and OpenAI to develop and release patched version of PHP 8.2, 8.3, 8.4, and 8.5.[3][2] Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life.[2] Both vulnerabilities were published through GitHub security advisories[7][8] on 21 October at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. It is notable for the fact that the PHP maintainers announced the update early and before release,[9] encouraging users to prepare and update as soon as the patch was released. One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release".[10] PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo.[6][11] Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability.[12][13] - Log4Shell 1. ↑ "PHP: News Archive - 20 Oct 2026". www.php.net. 2026-10-20. Retrieved 2026-10-21. 2. 1 2 3 "PHP: News Archive - 21 Oct 2026". www.php.net. 2026-10-21. Retrieved 2026-10-21. 3. 1 2 "Patch the Planet: global response coordination as agents uncover critical vulnerabilities". OpenAI (Press release). 21 October 2026. Retrieved 21 October 2026. 4. ↑ "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet". Retrieved 2026-10-21. 5. ↑ "php.announce: [ANNOUNCE] Upcoming Critical PHP Security Release". news-web.php.net. Retrieved 2026-10-21. 6. 1 2 Abrams, Lawrence. "PHP warns admins of two critical flaws, emergency patches coming tomorrow". BleepingComputer. Retrieved 2026-10-21. 7. ↑ "RCE via OOM corruption". 2026-10-21. Retrieved 2026-10-21. 8. ↑ "RCE via stale global state". 2026-10-21. Retrieved 2026-10-21. 9. ↑ "Critical vulnerabilities in PHP | Stay tuned for php2shell mitigation and patches". www.aikido.dev. Retrieved 2026-10-21. 10. ↑ Goodin, Dan (2026-10-21). "PHP warns it plans to release 2 emergency patches imminently". Ars Technica. Archived from the original on 2026-10-21. Retrieved 2026-10-21. 11. ↑ "Only for the curious..." jackalsyn.com. Retrieved 2026-10-21. 12. ↑ Knecht, Dane (21 October 2026). "Dane Knecht 🦭 (@dok2001) on X". X (formerly Twitter). 13. ↑ "Hold on to your butts: Web admins braced for emergency PHP updates to plug leaked exploits". PC Gamer. 2026-10-21. Retrieved 2026-10-21. - Announcement by the PHP Project