Introduction
Two critical remote-code-execution flaws were disclosed on the same day, each threatening a foundation piece of the modern web stack. On October 21, 2026, the PHP security team shipped emergency updates fixing CVE-2026-109618 and CVE-2026-109619 — a pair of bugs inside the PHP engine itself that let an attacker run code on a web server without logging in, even when the site's own code is secure. Hours later, GitLab released fixes for CVE-2026-110264, an unauthenticated flaw reaching every release back to version 7.0 from 2014. For defenders running either stack, October 21 was a day of urgent patching rather than careful review.
PHP2Shell: flaws in the engine, not the application
The two PHP flaws, collectively called PHP2Shell, sit in the PHP runtime rather than in any application built on it. That distinction matters. A site running WordPress, Laravel, or a custom framework is exposed even if its own source code has no vulnerability, because the flaw is in the PHP interpreter that executes the page.
Both bugs carry a CVSS v4.0 score of 9.2 and affect nearly every PHP branch back to version 5.4. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older branches 8.1, 8.0, and 7.4 receive only community source backports, so servers still on them are at increased risk.
Researchers at Wiz, Calif., and OpenAI's Codex Security team found the flaws, with help from the PHP security team and Google's Gemini team on the fix. The vulnerable code had been inside PHP for more than a decade. AI-assisted analysis turned long-standing primitives into working exploits, cutting what researchers say would have been months of manual work down to about a week.
Calif., which traced the bug's lineage to PHP research from 2004, cautioned that knowing the target's history still mattered — current models do not reliably start from obscure, twenty-year-old primitives on their own. The combination of a human who understands the codebase and a model that can grind through candidates is what produced a working exploit, and it is the combination that makes the disclosure timeline interesting.
Apache mod_php is the highest risk
PHP's own analysis singles out Apache's mod_php as the riskiest configuration. A single unauthenticated request can trigger the attack before any application code runs, and researchers at Wiz demonstrated live reads of a PHP worker process memory against applications they did not control. The memory may hold passwords, authentication tokens, API keys, and certificates belonging to other requests.
PHP-FPM behaves differently: it shuts down a worker when a request fails early, which blocks one confirmed path. But the second flaw was shown to reach code execution on both mod_php and PHP-FPM, though the FPM variant depends on an operation inside the running application.
No source has confirmed a successful break-in as of this writing. watchTowr reproduced CVE-2026-109618 and reported no exploitation in the wild as of October 21, and neither flaw had entered CISA's Known Exploited Vulnerabilities catalog. That changed within hours: Cloudflare said it was already seeing early exploit attempts against customer traffic, and watchTowr later confirmed active exploitation attempts of both CVEs. Cloudflare deployed firewall rules as a stopgap at 03:02 UTC on October 21, before the patches shipped.
The Hacker News reported that the Cloudflare rules were a stopgap and that attackers were observed changing their payloads to get around them — a pattern that makes signature-based blocking a weak primary defence when the vulnerable code is still running.
The disclosure itself broke down
The coordinated disclosure did not hold. Around 20:00 UTC on October 20, Calif. mistakenly published a video of its working proof of concept, and at 07:41 UTC on October 21 — roughly six hours before the fix shipped — the vendor Chainguard published container images containing the patch, letting anyone study the fix while other users were still waiting to update.
The PHP Foundation has also disclosed that a core developer first found signs of the out-of-memory flaw during PHP's 2024 external audit, but a working attack was only theorized and no concrete route to code execution was found. The Foundation said competing fixes each risked breaking compatibility, opening denial-of-service paths, or forcing changes on third-party extensions, and that a small team struggled to agree, so work stalled for months. It called the delay a structural failure of its decision process and its resources, and said it has since changed how it makes security decisions.
GitLab CVE-2026-110264: a decade of regex bugs
The same day, GitLab disclosed CVE-2026-110264, rated CVSS 10.0 — the maximum score — an unauthenticated remote code execution in the regular-expression compiler GitLab ships inside every release. The flaw affects GitLab self-managed versions back to 7.0 (2014), including branches GitLab normally stops patching.
GitLab fixed the issue in seven releases at once: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com itself already runs the fixed version, and GitLab Dedicated tenants on internal releases 19.3.5-internal0 and 19.4.2-internal0 or later have the fix. Only self-managed installations need to act.
The flaw reaches back so far because it lives in Onigmo, Ruby's regular-expression engine bundled inside GitLab's own packages. A weakness in Onigmo therefore exists wherever GitLab has shipped it, which is every release since 7.0. GitLab has not published the preconditions an attacker needs to reach the compiler, so administrators cannot rule themselves out by configuration — the fix is the only certain protection.
This is the fourth code-execution flaw in GitLab's regex engine reported by researcher joaxcar within a month. On September 23 GitLab fixed CVE-2026-93577 and CVE-2026-89078 (both 9.9, requiring a logged-in account), and on October 12 it fixed CVE-2026-97229, also unauthenticated at 10.0 but limited to versions 19.2 and later. CVE-2026-110264 is the first to drop below 19.2, pulling older installs back into scope.
The upgrade is not free. Releases 19.4.3 and 19.3.6 include database changes that run during upgrade, meaning downtime on single-node servers. Multi-node setups can apply the patch without downtime using GitLab's zero-downtime procedure. No interim workaround exists.
The Hacker News detailed the fix matrix, including the four backports GitLab reserves for severe issues, and noted that GitLab reported no sign of the flaw being used in attacks and that it was not listed in CISA's known-exploited catalog as of October 22.
The same release also fixed 11 security issues in total, one critical and the rest high, medium, or low. Two concern authentication: CVE-2026-15723 (high, 8.2) could allow a logged-in user to take over another account when an administrator has enabled both SAML and LDAP auto-linking, and a cache-poisoning flaw in GitLab's OAuth and OpenID Connect endpoints, CVE-2026-112212 (high, 7.5), could redirect certain sign-in flows to an attacker-controlled server where a shared cache is in use.
Convergence: the same day, two stacks
PHP and GitLab sit at different layers — one a language runtime, the other a source-code and CI platform — but both are the kind of infrastructure teams leave running for years between upgrades. The fact that both disclosed critical unauthenticated remote code execution on October 21 means many organizations faced a patch window for two separate systems on the same afternoon.
For PHP, updating an application such as WordPress or Laravel does not update the PHP runtime beneath it; the runtime comes from the server package, the host, or the container image. GitLab's older backports are equally easy to overlook because they sit outside the normal release support window. Both cases reward operators who inventory what they actually run rather than what they assume they run.
There is also a shared supply-chain lesson. In both cases, the flaw was reachable without authentication and the tooling to find it accelerated sharply. GitLab bundled its own copy of Onigmo and had to backport fixes across seven branches; PHP ships inside the language and inside every distribution package, host, and container image built on it. Components that get copied and vendored spread far beyond the project that wrote them.
What to do now
- PHP administrators: update the PHP runtime to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, then restart Apache, PHP-FPM, and any long-running PHP workers. Check package changelogs rather than version strings, since distribution vendors can carry the fix under an old-looking number.
- GitLab administrators: upgrade self-managed instances to one of the fixed releases above. Review detection rules "Onigmo native worker crash" and "Org mode render error burst" in GitLab's TLDR framework.
- For both stacks: review logs for unusual multipart requests, memory-limit errors, or repeated HTTP 500 responses that could indicate exploitation attempts.
- Treat configuration-level mitigations as temporary. PHP's advisory states plainly that only updating is a complete fix, and the workaround of disabling session upload progress does nothing for CVE-2026-109618.
More coverage of actively exploited flaws sits in our cybersecurity desk.
References
- PHP security advisory: https://www.php.net/security/
- Hacker News, "PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws": https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
- Hacker News, "Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases": https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
- CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog