-
BreachForums and Dread reportedly went offline after two serious PHP flaws became public.
-
Both flaws, CVE-2026-109618 and CVE-2026-109619, carry a critical score of 9.2 and could let hackers run harmful code remotely.
-
PHP released fixes on October 21, but security researchers and internet companies had already reported attack attempts.
Two serious flaws in PHP have set off a rush to protect websites. Reports say the hacker forums BreachForums and Dread went offline because of them. Together, the flaws carry the name PHP2Shell.
Security researchers and internet companies also reported attack attempts. The PHP team released fixes on October 21. Server owners now face pressure to update fast.
BreachForums and Dread Reportedly Pull Back From the Web
Two hacker forums reportedly took steps to protect themselves from the new threat. According to a security firm’s report, BreachForums announced it would stay offline until PHP gets patched worldwide. Dread also reportedly limited access after the flaws became public.
These moves show how risky the flaws are for websites and online services. That includes platforms that cybercriminals visit often. Still, the reports do not show that either forum suffered a successful attack. The available reporting describes both decisions as precautions.
Dread has faced other security concerns, including a separate claim that attackers gained control of its onion address after a private key leak.
The flaws also became public earlier than planned. Details leaked online on October 20, 2026. The PHP security team then moved its fix release up to October 21, according to the PHP project’s announcement.
Two Critical PHP Flaws Put Websites at Risk
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. They sit inside PHP itself. PHP is a coding language that runs on servers. WordPress, Drupal and Joomla all use it.
Both flaws earned a critical rating. Each one received a score of 9.2 under the CVSS v4.0 system. A hacker with no login could use them to run harmful code from far away. The same hacker could also read private data stored in PHP’s memory.
The two bugs come from different memory problems. CVE-2026-109618 involves damaged memory when a server runs out of space. CVE-2026-109619 involves old internal data that stays behind after memory gets freed.
Attack Traffic Appears Days Before the Fixes
Attacks began before the public warning. Cloudflare said it saw attack traffic aimed at its customers before the flaws became public. A later report, citing Amazon Web Services, said attacks started as early as October 17. That was several days before any fix existed.
These findings show the danger is not only theory. Hackers were already testing the flaws. Still, attack traffic does not prove that every attempt worked. It also does not prove that any single company suffered a confirmed break in.
The PHP project released its fixes on October 21. The updates cover PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Each update closes both flaws. Server owners should install them right away. They should also confirm that their hosting companies applied the fixes.
PHP 8.1 and older versions have the flaws too. Many of those versions no longer receive support. Some older versions have limited source backports. Even so, companies should follow the security advice from their vendors. They should also move to supported versions where possible, as a national health service cyber alert advises.
Security Teams Urge Quick Updates and Close Checks
Cloudflare has added web application firewall protections for its customers. These protections give websites an extra layer of defense. The company stresses that they do not replace the official PHP updates.
Teams should also check their server logs. They should look for odd requests and unexpected PHP worker activity. They should watch for signs that someone ran code without permission. Systems that may have been hit before patching need a closer look. An update alone does not remove an attacker’s existing access.
The reported shutdowns show how seriously people take PHP2Shell, even in underground groups. Attacks are already reported. So administrators should patch first and watch their systems closely. They should also investigate any strange activity instead of waiting for more reports.
