Two critical PHP remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, were disclosed after leaking early. They affect PHP versions 5.4 through 8.5 and were rated 9.2 severity. PHP released patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21. U.S. agencies including CISA, NSA, and FBI urged immediate patching or taking affected systems offline.
The flaws were found via AI-assisted research by Calif and Wiz, leaked on October 20 ahead of planned disclosure, and prompted a fast patch cycle. Exploitation attempts appeared quickly, including attempts detected by Amazon before public disclosure.
Polymarket has a market titled “US Gov confirms PHP2Shell exploited by...?” asking whether the U.S. government will confirm exploitation; the post itself does not claim the government has confirmed exploitation.
AGood morning, it's Saturday, six o'clock Eastern, and the overnight story is a security scramble for a huge chunk of the web.
APolymarket, the prediction market, just listed a market asking whether the U.S. government will confirm PHP2Shell was exploited.
AThat's a question, not a confirmation.
BAnd it's already the headline on half the dashboards.
BHere's what we actually know: two critical PHP vulnerabilities, rated nine-point-two severity, affect PHP versions five-point-four through eight-point-five.
APHP released patched versions for the affected branches on October twenty-first.
ACISA, the NSA, and the FBI all said patch immediately.
BThe NSA went further: unpatched systems should be taken offline, because the flaw is a direct path to compromise.
AAmazon says it saw exploitation attempts as early as October seventeenth, before public disclosure.
BBefore anyone says the internet is on fire— Sophos retracted its earlier report of successful exploitation.
ARight. As of Friday, scanning and failed attempts, but no confirmed mass exploitation.
BGoogle's threat intel lead called it viable and very serious.
ASo the real headline isn't panic. It's patch now, especially if you run PHP on anything public.
BAnd PHP still runs a huge chunk of the web, including a lot of WordPress.
AI get why agencies are loud, but I'm not canceling my Saturday over a flaw with no confirmed mass exploitation.
BYou don't have to be breached for a nine-point-two remote-code-execution flaw to be urgent.
AThe take offline line from NSA just feels unusually aggressive.
BBecause if it does get exploited, the cleanup is worse than a Saturday patch.
AFair. The flaws were found with AI-assisted research by researchers at Calif and Wiz, and they leaked before the planned disclosure.
BThat leak is why the patch cycle felt rushed.
ASo, quick clear takeaway: patch, or isolate, anything public running PHP.
BAnd keep an eye on whether that Polymarket market actually resolves.
BDifferent corner of the internet: crypto accounts are arguing with themselves about Bitcoin ETF flows this morning.
BTwo Bit Crypto posted total inflows slowed from five hundred twenty-seven million dollars to just twenty-three million.
BGwaendy Jn Baptiste posted BlackRock's spot Bitcoin ETF alone pulled in six hundred sixty-four million in a single day.
BGogo Green Shedrack posted five hundred twenty-six million in total inflows.
AThose can't all be right if they're talking about the same day.
AAnd we couldn't independently confirm any of those numbers.
BWe'll ignore the rally-or-crash takes until official flow data lands.
AThere's also a claim from Blockbuzz Hunter that Switzerland approved its first retail spot Bitcoin ETF.
ANo official confirmation from the Swiss regulator, so treat that as rumor for now.
BIf FINMA actually confirms it, that's a real story. Until then, it's just a headline.
AAnd the price posts are just as noisy: some say Bitcoin reclaimed eighty-three thousand, others say it's falling toward eighty.
BThis is why Saturday morning is better for coffee than for trusting unverified posts.
AWe'll stick to patching PHP and watching for official numbers.