[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-two-php2shell-flaws-affect-php-54-and-later-servers":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12019,"two-php2shell-flaws-affect-php-54-and-later-servers","Two php2shell Flaws Affect PHP 5.4 and Later Servers","Two memory-handling bugs in the PHP runtime need a PHP update, not a plugin fix, while Cloudflare's new firewall rules buy administrators some time.","Anyone running PHP 5.4 or later should update the PHP runtime itself, because two newly disclosed flaws known as php2shell sit below the application layer. Updating a plugin or site code will not fix them.\n\nCalif.io, Wiz, OpenAI and Quarkslab disclosed the bugs on October 21 as CVE-2026-109618 and CVE-2026-109619. A specially crafted HTTP request could cause denial of service, remote code execution or data exposure. If a host manages your PHP, ask it to apply the security update. Limiting upload sizes may reduce exposure, Cloudflare said, but it is no substitute for the patch.\n\nBoth bugs involve memory handling when a request fails midway. In the first, PHP runs out of memory before some internal data is initialized, then uses that unfinished data during cleanup. In the second, a fatal error leaves PHP holding references to memory that is freed when the request ends. A later request handled by the same process can follow those stale references and access memory it should not.\n\nCloudflare said it worked with the PHP Foundation, OpenAI, Wiz and others on mitigations. By its account, firewall rules were live for free and paid plans by 3:02 am UTC on October 21, about nine hours before disclosure. The company also said the details leaked ahead of the official release date, that it saw attack traffic aimed at its customers, and that attackers altered their payloads to slip past its rules.\n\nThe more interesting detail is how the defense works. Request data alone often cannot separate an exploit from legitimate traffic, so Cloudflare built what it calls full transaction detection. It weighs the request and the origin server's response together and can block a response before it reaches the requester. These are the first managed detections to use it. Reading responses is a sensible way to cut false positives, but it only buys time, and the company itself tells customers to patch.\n\nPHP runs almost 70% of websites, according to Cloudflare, including platforms such as WordPress and Magento. Whether response-side inspection stays a one-off for php2shell or becomes a standard part of the firewall is an open question.","[\"php\",\"vulnerability\",\"waf\",\"cloudflare\"]","2026-10-21T13:56:45.000Z","2026-10-21T14:06:09.973Z","2026-10-21T14:06:10.210Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the meta-commentary in the last paragraph ('The source does not say whether older PHP branches will receive fixes'). Either drop it or state it as a plain open question without referring to the source. Also make sure the claim that the PHP Foundation was part of the disclosure group is attributed accurately: Cloudflare says only that it worked with the PHP Foundation, OpenAI and Wiz, among others.","resolved","security",[32,33,34,35],"php","vulnerability","waf","cloudflare",[37],{"name":38,"url":39},"Cloudflare Blog","https:\u002F\u002Fblog.cloudflare.com\u002Fphp-vulnerabilities-waf-protection\u002F",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,91,96,101,106],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7051,"2026-10-21T14:20:15.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1028,"2026-10-21T14:35:46.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",560,"2026-10-21T13:46:18.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",544,"2026-10-21T11:57:35.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",279,"2026-10-21T13:00:00.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",262,"2026-10-21T15:00:00.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",211,"2026-10-21T09:00:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",138,"2026-10-21T14:03:11.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",134,"2026-10-20T14:57:15.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":66},"Dev Tools","dev-tools",121,{"name":92,"slug":93,"count":94,"latest_published_at":95},"General","general",92,"2026-10-21T13:34:37.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Gaming","gaming",84,"2026-10-21T02:56:30.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]