World · Web Application Security
Critical PHP Security Update: php2shell Vulnerabilities Fixed
Kaynak duyuru tarihi: 2026-10-21 · Haber/olay tarihi: 2026-10-21
PHP project released security fixes for CVE-2026-109618 and CVE-2026-109619 in October 21. The official announcement pays attention to the PHP installations processing the web request. Priority for corporate website managers, not only app add-ons, verify the update status of PHP package that works on the application.
Which versions are announced?
PHP’s official archive lists fixes for 8.5.12,8.4.27,8.3.36 and 8.2.35 versions. The announcement states that two deficits can lead to remote code operation without authentication. Institutions using deployment or long-term support provider should also check the security correction of their own package provider; version number and package nozzle are not the same evaluation.
Cloudflare also informs that WAF protections for php2shell in the separate description of October 21 and although PHP update should be made. This additional layer does not replace the correction on the source server. Both welding and announcement events dated October 21; Published on this news 22 October 2026. Quad doesn’t offer a finding on the attack of any customer.
Quad Bilişim commentary
The development reminds the importance of working time up to the application code in the web infrastructure. Separate issues with the scope of corrections in the announcement that a particular site is affected and not affected.
Welding and verification
PHP: Critical security announcement and corrected versions — 21 October 2026
News information was verified from primary source. “Quad Bilişim assessment” sections are editorial interpretation; The description or measured performance of the manufacturer is not a result. It is a visual original and representation.