PHP Warns of New Unpatched RCE, No Patch Available
PHP's security team disclosed a new RCE flaw affecting non-default server configurations. No patch is out; mitigation guidance has been published.
Morgan "airgap" ReyesNo patch. PHP’s security team disclosed a new remote code execution vulnerability Thursday, two days after emergency fixes shipped for the PHP2Shell flaws. Separate issue.
Scope: non-default PHP configurations only, per BleepingComputer and The Hacker News. Default installs are not reported as affected.
A CVE has been assigned per both outlets but is not yet verifiable against NVD or MITRE at time of publication. Treat current technical scope as preliminary until the advisory resolves in the public databases.
PHP has published mitigation guidance for operators running the affected configurations. No patch timeline has been announced. Both outlets link to PHP’s security advisory for the mitigation specifics.
Context
PHP2Shell patches landed Tuesday in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Active exploitation of CVE-2026-109618 and CVE-2026-109619 is confirmed, including attempts to deploy the Mirai-variant Potassium botnet. No exploitation of the new unpatched issue has been reported at this time.
PHP runs on an estimated three-quarters of all web servers. The reach of this vulnerability is narrower than PHP2Shell because it requires non-default configuration. Full scope confirmation is pending a patch and complete technical disclosure from the PHP team.
Found this useful? Share it.
