Published: October 22, 2026 | Last updated: October 23, 2026
Two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, allow unauthenticated attackers to execute code remotely on vulnerable servers. Both carry a CVSS v4.0 score of 9.2 (Critical).
The flaws sit in core PHP, not in WordPress, Drupal, Joomla or any other application. Every PHP installation that serves web requests is in scope: Apache mod_php, PHP-FPM, php-cgi, LiteSpeed and FrankenPHP. The PHP security team rates mod_php as the highest risk, because an unauthenticated request can trigger the attack before any application code runs. Every PHP branch is affected up to the October 21 fixes, including long end-of-life versions.
This is not theoretical. Amazon's honeypot network recorded an exploitation attempt on October 17, four days before the CVEs were public. Cloudflare reported early attacks on release day, VulnCheck has observed active scanning and at least one web shell attempt, and public proof-of-concept code is circulating.
The vulnerabilities were found by researchers from Calif, OpenAI and Wiz using AI-assisted techniques. The gap between discovery and exploitation is now measured in days, and a quarterly pentest does not fit inside that window.
The PHP security team released fixes on October 21, 2026. Installing them is necessary but not sufficient: teams also need to find every PHP runtime they run, restart the worker processes that keep old code in memory, and retest to confirm the exposure is actually closed.
Key takeaways
- Two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution or disclosure of process memory.
- Actively exploited: exploitation attempts predate public disclosure, and proof-of-concept code is public.
- Every branch affected: fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (October 21, 2026). PHP 8.1 and older receive no official release.
- Exposure extends beyond websites: containers, control panels and vendor appliances that bundle their own PHP runtime are affected too.
- Patching requires verification: confirm the updated runtime is the one actually running in memory, then retest from the outside.
- Free PHP2Shell pentest by Plainsea: find exposed PHP endpoints and retest after patching to confirm the fix landed.
Understanding the vulnerabilities
PHP2Shell is two memory-safety flaws in how the Zend Engine handles fatal errors (longjmp()) and worker state that persists across requests:
-
CVE-2026-109618: RCE via out-of-memory corruption (GHSA-w8hw-w9fx-j79w). PHP uses_ longjmp()_ to abort request handling when it runs out of memory. If that happens while internal request structures are only partly initialized, the cleanup routine can treat uninitialized memory as valid pointers. An attacker who can drive the process into memory exhaustion can turn this into pre-authentication code execution.
-
CVE-2026-109619: RCE via stale global state (GHSA-6wmf-4rv5-p3rp). PHP keeps global variables that briefly point into request-owned memory. Under certain error-handling or upload-tracking conditions, such as _session.upload_progress _or fatal error backtraces, that state survives after the memory behind it is freed. When the same persistent worker handles the next request, it can read the stale memory before initialization resets it, leading to memory disclosure or code execution.
Affected versions and patch matrix
The PHP security team released patched versions on October 21, 2026 at 14:00 UTC. Check your inventory against the matrix below.
| Branch | Support status | Vulnerable | Fixed in | Action |
|---|---|---|---|---|
| PHP 8.5 | Active support | 8.5.0 – 8.5.11 | 8.5.12 | Update now via official packages, images or source. |
| PHP 8.4 | Active support | 8.4.0 – 8.4.26 | 8.4.27 | Update now via official packages, images or source. |
| PHP 8.3 | Security fixes only | 8.3.0 – 8.3.35 | 8.3.36 | Update now via official packages, images or source. |
| PHP 8.2 | Security fixes only (ends Dec 31, 2026) | 8.2.0 – 8.2.34 | 8.2.35 | Update now, and plan the move to 8.3+ before year end. |
| PHP 8.1, 8.0, 7.4 | End of life | All releases | Source backport only | PHP published minimal source backports but no releases. Use your distribution's patched package or upgrade to 8.2+. |
| PHP 7.3 and older | End of life | All releases | None | Upgrade to a supported 8.x branch, or take the system offline. |
Note: Linux distributions often backport fixes without changing the version string. A server reporting 8.2.20 on Debian or RHEL may be patched; a server with its version banner stripped will not show up in a version scan at all. Version checks are a starting point, not a verdict.
Get a free PHP2Shell pentest by Plainsea against your internet-facing endpoints. Find what's exposed and prove it's fixed.
