The PHP security team has released emergency patches for two critical unauthenticated remote code execution (RCE) vulnerabilities, tracked collectively as PHP2Shell, affecting all PHP installations that serve web requests. Reported by BleepingComputer, the flaws are CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS v4.0 score of 9.2, according to Tenable.
Researchers at Calif, Wiz, and OpenAI discovered the flaws. Affected deployment types include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. ‘We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs,’ the PHP security team said.
What the two vulnerabilities do
Both flaws share the same underlying cause: abnormal request termination can corrupt PHP’s memory state. CVE-2026-109618 allows remote code execution as the web worker account by triggering a chain of weaknesses that cause out-of-memory corruption. CVE-2026-109619 is a stale global state vulnerability that permits unauthenticated heap use-after-free, leading to memory disclosure and remote code execution under the web worker’s privileges.
Admins running PHP 8.x should install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible. Those still on PHP 7 or earlier should migrate to a fixed release. ‘PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version,’ the PHP developers said. The team also noted it had provided minimal source-backports for PHP 7.4, 8.0, and 8.1 to help those building from source or without access to an LTS vendor.
Early exploitation attempts and advance warning
According to Aikido, the PHP security team published an advance notice on 20 October 2026 after information about the vulnerabilities leaked ahead of the planned disclosure date, prompting the team to move the release up to 21 October. Tenable reported the patches were scheduled for release at 14:00 UTC on 21 October 2026.
Before the patches were released, Cloudflare CTO Dane Knecht confirmed the company had already deployed WAF rules designed to block known PHP2Shell exploitation methods and was observing early attacks targeting both vulnerabilities. Knecht stressed those protections were temporary and urged all admins to install the security updates as soon as possible.
PHP core developer Gina Peter Banyard cautioned that none of the available mitigations would provide complete protection against attacks, and that the only permanent defence is applying the official patches. The UK National Cyber Security Centre (NCSC) also warned UK organisations to update PHP systems immediately or take them offline until they can be patched.
Temporary mitigations for those unable to patch immediately
The PHP security team published a set of partial mitigations for admins unable to patch straight away, while making clear they do not fully protect against exploitation. For CVE-2026-109618, the team recommends setting memory_limit=-1 at the server level (not overridable by applications), using a low post_max_size (8M for sites without file uploads, 32M where uploads are needed), and applying a container or cgroup limit to contain affected workers. For CVE-2026-109619, admins should set session.upload_progress.enabled=0 and restart workers; on PHP 8.5, setting fatal_error_backtraces=0 and restarting workers blocks only the confirmed fatal backtrace path.
PHP powers an estimated 75% to 80% of all websites. VirusTotal figures cited in the source indicate that more than 5.1 million PHP hosts are reachable online, of which around 3.8 million have at least one port exposed.
