Critical PHP Vulnerabilities (PHP2Shell)

What CVE-2026-109618 and CVE-2026-109619 Mean and How to Patch

By the Cyber Defentech editorial team | Updated October 22, 2026

Most web servers never announce what language they run. Yet a large share of the internet answers requests through PHP, and on October 21, 2026 the PHP project told every one of those operators to stop what they were doing and update. Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution. In plain terms, an attacker who can reach a vulnerable server over the network may be able to run their own code on it without a password, an account or a stolen session.

These critical PHP vulnerabilities live in the PHP engine itself, not in a plugin or a poorly written application. That matters: a perfectly maintained WordPress, Magento or Laravel site still inherits the problem if the runtime underneath it is unpatched. The issues have been nicknamed PHP2Shell in industry reporting, and the US Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch immediately.

This guide explains what is confirmed, what is still uncertain, which versions are fixed, and how to patch and verify without guesswork.

What the Alert on These Critical PHP Vulnerabilities Actually Says

Two organizations are involved, and they play different roles. The PHP project maintains the language and is the authority on how the bugs work, which releases fix them and what partial mitigations exist. CISA is a government agency that does not write PHP patches; its job is to tell defenders how urgent a problem is and to push them to act.

PHP’s security advisory says the fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and that all PHP installations serving web requests are at risk. A day earlier, the project had pre-announced the release and rated both issues 9.2 on the CVSS v4.0 scale, which falls in the critical band. CISA’s alert, according to its published summary, calls for immediate patching to those same releases and describes both flaws as enabling unauthenticated remote code execution.

A word on how to read the evidence. The CVE identifiers, fixed versions, scores and technical descriptions come from PHP.net. CISA’s contribution is the urgency and the call to act. Anything about attacks in the wild comes from other parties and is discussed separately below, with dates, because that picture changed within hours.

CVE-2026-109618: When Running Out of Memory Becomes the Attack

PHP’s advisory labels this one remote code execution through out-of-memory (OOM) corruption. When PHP begins handling a request, it builds a set of internal structures describing that request. If memory runs out partway through that setup, PHP can be interrupted while those structures are only half built. The cleanup routine that runs afterward may then treat the half-built data as if it were complete and valid.

A simple analogy: imagine a clerk filling out a multi-page form when the fire alarm goes off. A colleague later collects every form on the desk, assumes each one is finished, and starts acting on the blank sections as though they held real information. The harm does not come from the alarm. It comes from trusting something that was never completed.

In software, acting on invalid internal data is a classic route to memory corruption, and memory corruption in a language runtime is a classic route to code execution. PHP states that for mod_php there is a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs. That detail is important for defenders: it means a clean, well-reviewed application does not protect you, because the problem occurs earlier than your code.

CVE-2026-109619: Leftover State That Outlives Its Memory

The second flaw is described as remote code execution through stale global state. PHP keeps certain request-related information in internal state. In this case, that state can survive after the memory backing it has already been released. A later request handled by the same worker process may then use that stale state before PHP resets it as part of normal initialization.

This is a use-after-free condition. Think of a coat-check ticket that is supposed to be void once the coat has been returned, but the cloakroom still honors it. By the time someone presents the ticket, the hook may hold a stranger’s property. Software that reads or writes through a dangling pointer can be steered into corrupting data or redirecting execution, which is why this bug class is so often tied to remote code execution.

The two flaws differ in their trigger and their timing. CVE-2026-109618 is about a failure during setup, when memory allocation fails and leaves incomplete data behind. CVE-2026-109619 is about a failure to clear state between requests, so the danger crosses from one request to the next inside a long-lived worker. PHP’s advisory ties the second issue to specific paths, including session upload progress and, on PHP 8.5, fatal error backtraces. Independent researchers have published additional technical commentary, but the advisories linked in the references remain the authoritative source.

Why These Critical PHP Vulnerabilities Matter Beyond the Headline

If code execution is achieved, what an attacker can do depends on the privileges of the PHP process and the surrounding environment. The realistic range of impact includes:

• Running arbitrary commands as the web server or PHP-FPM user.
• Reading application files and configuration, which often contain database passwords, API keys and signing secrets.
• Compromising the website or application, for example by planting a web shell or altering content.
• Disrupting service, since memory corruption can also crash workers.
• Moving to connected systems when the server can reach databases, internal APIs or cloud metadata services.

These are potential consequences of successful exploitation, not proof that any particular server has been attacked. Their severity depends on how the server is configured, what it can reach and how well it is segmented.

Affected PHP Versions and Fixed Releases

PHP.net lists the fixed releases for the supported branches hit by the critical PHP vulnerabilities. It states that all installations serving web requests are at risk, and it does not publish a lower bound in the announcement itself. Some third-party reporting, including a Wikipedia summary attributing the finding to Wiz, says versions as old as PHP 5.4 are affected. Treat that as secondary reporting: unless your vendor confirms a version is fixed, assume it is not.

For PHP 8.1 and older, the project no longer issues updates. Some Linux distributions and long-term support vendors provide backported fixes, so contact yours. Because of the severity, the PHP security team also published minimal source backports on branches for PHP 7.4, PHP 8.0 and PHP 8.1 for teams that build from source. These are a stopgap, not a substitute for moving to a supported release.

Two cautions apply to packaging. First, Linux distributions received the patches in advance, so your package manager may already offer the fix under a distribution-specific version number that does not match the upstream one. Check the vendor’s security notice rather than comparing numbers by eye. Second, PHP’s advisory warns that the volunteer-maintained rpms.remirepo.net repository would not have updates on release day and urges users to switch to distribution packages or build from source. Check whether that has since changed before relying on it. Bundled runtimes in containers, appliances and third-party products need the same scrutiny, since they carry their own copy of PHP.

Who Is Exposed to These Critical PHP Vulnerabilities

PHP names the execution models affected by the critical PHP vulnerabilities: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is not identical across them. PHP considers it highest for mod_php, where the demonstrated exploit fires before application code runs. That does not make the others safe; it means the exploitability evidence differs.

In practice, the following deserve a first look:

• Internet-facing web servers using any of the above.
• Shared and managed hosting platforms, where one vendor patches many customers.
• Containers and images that bundle PHP and may sit unchanged for months.
• Commercial and open-source products that ship their own PHP runtime.
• Long-running workers, since CVE-2026-109619 involves state carried between requests.

How Organizations Should Respond to CISA’s Warning

CISA’s published guidance is direct: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Everything beyond that in this section is general practice, and we label it so.

Exploitation status needs careful wording. According to a reading of CISA’s alert, CISA had not observed exploitation when it published, and neither CVE was in its Known Exploited Vulnerabilities catalog as of 21:03 UTC on October 21. Other parties reported different findings. Sansec’s analysis says Cloudflare reported early attacks at 07:43 UTC on October 21, before the fixes were released, and Help Net Security reports that Amazon Threat Intelligence recorded an exploitation attempt on October 17. The UK’s National Cyber Security Centre, per the same report, urged organizations to consider taking offline any system that cannot be fixed right away.

The responsible takeaway is that a statement of no observed exploitation describes what one organization had seen at one moment. It does not mean exploitation is impossible, and later reports suggest attempts began before the patch existed. Reassess the status when you read this, since it is moving quickly.

A Practical Patching and Verification Guide

To remediate the critical PHP vulnerabilities, follow these steps. They are general defensive practice, not a CISA checklist.

1. Inventory every PHP installation. Include web servers, containers, CI images, staging systems and vendor appliances. The forgotten staging box is a frequent weak point.
2. Identify the version and execution model for each: mod_php, PHP-FPM, php-cgi, FrankenPHP or LiteSpeed. This tells you how urgent each system is and which restart you need.
3. Select the correct fix. Map each branch to its fixed release in the table above, or to your vendor’s patched package.
4. Update through trusted channels: php.net downloads, your distribution’s repositories or your vendor. Avoid unverified third-party builds.
5. Restart what runs PHP. Workers, FPM pools, Apache, containers and queue consumers can keep serving the old code until restarted.
6. Confirm the active runtime. Run php -v, but remember it reports the command-line binary, which may differ from the one your web server uses.
7. Check the web-server PHP separately. Compare package versions, the FPM binary version or a temporary, access-restricted diagnostic page, and remove it afterward.
8. Review logs for the period before patching: unusual requests to upload endpoints, spikes in fatal errors or timeouts, and worker crashes.
9. Investigate anything suspicious. Look for unexpected files, new scheduled tasks, unfamiliar processes and outbound connections from web servers.
10. Track and document completion per system, including the date, the version reached and who verified it.

Temporary Mitigations Are Not a Fix

PHP’s guidance on these critical PHP vulnerabilities is blunt: only an update is a complete solution, and the measures below reduce exposure to specific attack paths without making an installation safe. Its release notes add that there are no complete mitigations and that updating is the only safe choice.

For CVE-2026-109618, the advisory suggests:

• Setting memory_limit=-1, ideally in a way applications cannot override, such as php_admin_value. This removes one controllable failure, but an underlying allocation failure can still reach the vulnerable path.
• Lowering post_max_size (8M if uploads are not needed, 32M if they are), keeping upload_max_filesize below it, and enforcing request-size, field-count and nesting limits at the web server or proxy.
• Using a container or cgroup limit that kills only the affected worker. PHP warns against RLIMIT_AS or RLIMIT_DATA, which can themselves cause the vulnerable allocation failure.

For CVE-2026-109619, it suggests:

• Setting session.upload_progress.enabled=0 in php.ini, an FPM pool or server configuration, then restarting every worker. This blocks the confirmed session paths, not other variants.
• On PHP 8.5, setting fatal_error_backtraces=0, which blocks only the confirmed fatal-backtrace path.
• Removing invalid or deprecated per-request settings that emit diagnostics before initialization. Hiding errors with error_reporting, display_errors or @ does not help.
• Fixing attacker-reachable fatal errors and execution timeouts.

A web application firewall can add a layer of detection or blocking, but it is not equivalent to fixing the engine, and no vendor rule set can be assumed to cover every variant. Use these measures to buy hours, then patch.

Long-Term PHP Security Habits That Pay Off

Critical PHP vulnerabilities like these test routine hygiene more than heroics.

• Keep a living software inventory. The first hour of any emergency goes to finding out what you run and where.
• Practice regular patching. Teams that apply monthly updates move faster on the urgent ones.
• Use supported PHP versions and plan the lifecycle. PHP 8.2 reaches end of life on December 31, 2026, and unsupported branches leave you waiting on vendors.
• Apply least privilege. If the PHP process runs with minimal rights and limited file access, successful code execution does less damage.
• Segment the network. A compromised web tier should not have open access to databases and internal systems.
• Manage configuration centrally. Settings that cannot be overridden per application, as PHP’s mitigations require, depend on consistent configuration control.
• Log and monitor centrally. Logs on a compromised server are not trustworthy evidence; copies elsewhere are.
• Test your backups. A backup you have never restored is an assumption.
• Prepare for incidents. Know who decides to take a system offline before you need to.
• Follow vendor advisories. Subscribe to PHP, distribution and product security feeds so you hear first.

Frequently Asked Questions

1. What are CVE-2026-109618 and CVE-2026-109619?
They are two critical PHP vulnerabilities that can allow unauthenticated remote code execution. The first involves out-of-memory handling that leaves request data partially initialized; the second involves stale internal state that survives after its memory is freed. Industry reporting calls them PHP2Shell.

2. What is remote code execution?
It means an attacker can make a remote system run code of their choosing. When no authentication is needed, anyone who can reach the service may attempt it.

3. Which PHP versions contain the fixes?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older receive no project updates, so rely on a vendor backport or upgrade.

4. Are all PHP applications equally exposed?
No. These critical PHP vulnerabilities put all installations serving web requests at risk, but PHP but considers mod_php the highest risk because of a demonstrated pre-application exploit. Configuration and execution model change the picture.

5. Can a web application firewall replace PHP patching?
No. A firewall may block some attempts, but PHP states that only an update is a complete solution.

6. What should administrators do if they cannot patch immediately?
Apply PHP’s listed mitigations, restart all workers, restrict exposure where possible and monitor closely. The UK NCSC, as reported by Help Net Security, urged considering taking unpatchable systems offline. Then schedule the update as the top priority.

7. How can administrators verify the PHP version used by a website?
Check the package or binary actually launched by the web server or FPM service, not just php -v on the command line. Confirm after a restart that workers are running the updated build.

8. Does installing the patch eliminate the need to investigate a suspected compromise?
No. A patch closes the door going forward; it does not remove anything an attacker already planted. If you were exposed before updating, review logs and look for signs of compromise.

Conclusion

Patching the critical PHP vulnerabilities and verifying the result are the practices Cyber Defentech teaches because they work., can be reached without credentials and affect the dominant ways PHP is deployed. The fixes exist. The work now is identifying every runtime you operate, moving each to a fixed release or a vendor-patched package, restarting what serves requests and proving the active version rather than assuming it.

If a system was exposed before it was patched, treat investigation as part of remediation, not an optional extra. Patching and verification are the practices Cyber Defentech teaches because they work: know what you run, update from trusted sources, and confirm the result.

References & Further Reading

• PHP.net security advisory (21 Oct 2026): https://www.php.net/archive/2026.php#2026-10-21-5
• PHP.net advance notice (20 Oct 2026): https://www.php.net/archive/2026.php#2026-10-20-1
• CISA alert, Critical Vulnerabilities in PHP Require Immediate Patching: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
• GitHub advisories: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w and https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• Help Net Security: https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
• Sansec research: https://sansec.io/research/php2shell
• Brandefense summary: https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/

Upgrade Your Cybersecurity Skills with Cyber Defentech

Stay ahead of emerging cyber threats with practical cybersecurity training and industry-relevant skills.

Explore our cybersecurity courses and learn how to identify vulnerabilities, strengthen security, and protect digital assets.

Ready to build your cybersecurity skills?

🌐 Website: https://cyberdefentech.in
📧 Email: training@cyberdefentech.com
📞 Contact: +91 8448046612

Educate | Evaluate | Initiate