Our takePHP released emergency patches for two critical RCE flaws (CVE-2026-109618, CVE-2026-109619) dubbed PHP2Shell. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately, starting with internet-facing systems.Security Resilience desk
Sources (15)
- cert_eu · cert_eu
- csa_sg · csa_sg
- cisa_advisories · cisa_advisories
- cccs · cccs
- unit42 · unit42
- helpnet · helpnet
- bleeping · bleeping
- acsm_au · acsm_au
- helpnet · helpnet
- register_sec · register_sec
- acsc_alerts · acsc_alerts
- hackernews · hackernews
- cisa_kev · cisa_kev
- cisa_kev · cisa_kev
- bleeping · bleeping
What this means for you — Security leader:Apply the PHP security updates (8.5.12, 8.4.27, 8.3.36, 8.2.35) immediately on all internet-facing systems; test in staging first where possible.
What this means for you — Lean IT orgs:Update PHP on your web server or hosting control panel as soon as the patches drop today; if you cannot update right now, take the site offline until you can.
What this means for you — MSP:Deploy the new PHP versions (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35) across all client environments today, prioritising internet-facing web servers first.
What this means for you — Researcher:CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution; details remain limited until the patches and analysis are public.