PHP releases patch 8.5.12 after acknowledging a serious security flaw
PHP developers released a security patch, version 8.5.12, after acknowledging a serious vulnerability affecting websites and online services built with the language, including CMS such as WordPress, Joomla!, Drupal, Moodle and Typo3. The flaws, named "PHP2Shel" and registered as CVE-2026-109618 and CVE-2026-109619, allow remote code execution without authentication. Germany's BSI issued a "3 / Orange" risk alert and recommended disconnecting servers if patches cannot be applied. Municipalities, universities and hospitals have shut down services.
In 35 seconds
- PHP released version 8.5.12 with the patch for the "PHP2Shel" vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
- The flaws allow remote code execution without authentication and full control of a site, according to the report.
- Germany's BSI rated the risk "3 / Orange" and raised disconnecting servers if they are not patched quickly.
IASummary generated by artificial intelligence from a story by DW.com. It may contain errors: the original source prevails.




Comments
Be respectful. Comments reported by several people are hidden until a moderator reviews them.
You do not need an account to read, only to comment. Sign in with a code sent to your email or with your Google account. We only show the name you choose, never your email.