PHP 8.2.35 patch fixes critical RCE flaws amid Chainguard disclosure dispute
PHP maintainers released version 8.2.35 to fix two critical remote code execution vulnerabilities, dubbed PHP2shell, discovered by AI-assisted researchers at Calif, OpenAI, and Wiz. The update addresses CVE-2026-109618 and CVE-2026-109619, allowing unauthenticated attackers to execute code on servers. The release was accelerated after Chainguard, a supply chain security firm, inadvertently leaked details, prompting immediate updates for the vast PHP user base before the 2026 end-of-life date.
Key points
- The PHP development team released version 8.2.35 to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which enable unauthenticated remote code execution on servers.
- Researchers at Calif, OpenAI, and Wiz identified the flaws between August and September using AI models, leading to the collective designation of the bugs as PHP2shell.
- PHP maintainers accused Chainguard, a software supply chain security company, of disrupting the official disclosure process when CVE IDs circulated on social media around 15:00 UTC on Tuesday.
- The leak forced maintainers to move the planned disclosure from Thursday to Wednesday, warning distributors and users before technical details became public.
- With no complete mitigations available, updating to 8.2.35 is the recommended solution for users, who must plan upgrades before PHP 8.2 reaches end of life on 31 December 2026.
The PHP development team has released version 8.2.35, an emergency update designed to fix two critical security vulnerabilities that expose a significant portion of the web to unauthenticated remote code execution. The flaws, collectively referred to as PHP2shell and tracked as CVE-2026-109618 and CVE-2026-109619, were identified between August and September by researchers at Calif, OpenAI, and Wiz. All three firms reported using AI models to uncover the issues, which allow attackers to execute code on servers running the popular scripting language without prior authentication.
The release process was complicated by a disclosure dispute involving Chainguard, a company specializing in software supply chain security. According to PHP maintainers, the official announcement was originally scheduled for Thursday. However, on Tuesday around 15:00 UTC, CVE IDs and preliminary details began circulating on online forums and social media, attributed to Chainguard’s activities. This premature leak included incorrect information regarding release timing and CVSS severity ratings, prompting maintainers to accelerate the timeline and publish a blog post explaining the situation.
The irony of the situation is noted by developers, as Chainguard aims to secure open-source supply chains but inadvertently caused a messy disclosure. With no complete mitigations available, updating to 8.2.35 is considered the only safe choice for most users. The release is particularly urgent because PHP 8.2 reaches its end of life on 31 December 2026, after which it will no longer receive security fixes. Maintainers encourage users to plan their upgrades to supported versions to ensure long-term security.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
