What Happened
The Hacker News reports PHP shipped emergency patches on October 21 for two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0. The bugs sit in the PHP runtime, not in application code, so a site with clean code is still exposed. Wiz Research, Calif, and OpenAI’s Codex Security team found them. Fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Cloudflare reported early exploit attempts and deployed firewall rules. watchTowr saw no confirmed in-the-wild exploitation as of 11:26 UTC, and neither flaw is in the CISA KEV catalog yet. Krebs on Security reports nearly 70 percent of websites need core software updates.
Why This Matters for Canadian Organizations
The impact reached Canada on day one. BambooHR took its service offline in the United States, Canada, and Ireland as a precaution and warned payroll would be interrupted. Dutch government sites went dark as well.
Canadian organizations run PHP in WordPress, Drupal, Magento, Joomla, and custom intranets. The flaws also allow memory reads from PHP workers, which exposes passwords, tokens, and API keys from other requests. A confirmed read of personal information starts a PIPEDA breach assessment. Updating WordPress or Laravel does not update the PHP runtime, and municipal, university, and small business sites often miss this step.
What to Do
Inventory every PHP runtime, including containers and shared hosting. Upgrade to a fixed release and ask your hosting provider for its patch status in writing. Check package changelogs for the CVE IDs, because Linux distributions backported fixes without changing version strings.
Until you patch, set memory_limit to -1, set session.upload_progress.enabled to 0, and restart workers. Treat these as stopgaps only. Watch for multipart requests followed by memory-limit errors, repeated HTTP 500 responses, oversized PHPSESSID cookies, and unexplained worker restarts. Plan your move off PHP 8.2 before it reaches end of life on December 31, 2026. Read more in our TechTalk archive.
