On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities in the PHP runtime itself. Collectively nicknamed PHP2Shell, these flaws (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution (RCE) on affected servers. Both received a CVSS v4.0 score of 9.2 (Critical).

These are not application-level bugs in WordPress, Laravel, Drupal, or any specific framework. They sit deep in the PHP engine (memory handling and request cleanup), so even a simple “Hello World” script or a fully updated CMS can be vulnerable if it runs on an unpatched PHP version.

Who Found Them?

The vulnerabilities were discovered through coordinated research involving multiple parties:

• Calif (researcher Ryan Austin) originally discovered and coordinated the disclosure, working with OpenAI’s “Patch the Planet” initiative.
• Wiz Research independently found the same issues several weeks later.
• OpenAI, Wiz, Cloudflare, and other partners contributed research, technical support, and coordination during the two-month responsible disclosure process led by the PHP maintainers.

AI tools reportedly played a significant role in accelerating the discovery of these long-standing memory-safety issues.

Impact Level

Critical – Unauthenticated Remote Code Execution

• Severity: CVSS 9.2 (Critical) for both CVEs.
• Attack vector: Remote, unauthenticated. In the highest-risk case (Apache with mod_php), a single malicious request can trigger the vulnerability before any application code runs.
• Affected systems: All PHP installations that serve web requests, including:
  • Apache + mod_php
  • PHP-FPM
  • php-cgi
  • FrankenPHP
  • LiteSpeed
• Scope: Affects PHP versions going back to PHP 5 (2004). Official patches were released only for the supported branches (8.2+). Older versions (8.1 and below) are end-of-life and received only limited/minimal backports in some distributions.
• Real-world risk: Extremely high. Proof-of-concept exploits (including a tool called PHP2Shell) were demonstrated against popular platforms such as WordPress, Drupal, Joomla, Magento, Laravel, Symfony, and others. Exploitation attempts were observed in the wild even before the public release of the patches, and mass scanning began almost immediately after disclosure. Some organizations temporarily took sites offline as a precaution.

In addition to RCE, the flaws can also enable reading of sensitive process memory (passwords, tokens, API keys, certificates) belonging to other requests or the server itself.

The Two Vulnerabilities (Simplified)

1. CVE-2026-109618 – RCE via Out-of-Memory (OOM) Corruption
   When a request causes PHP to hit its memory_limit at a precise moment during request initialization, partially initialized internal data can be left behind. Cleanup code later treats this invalid data as valid, leading to memory corruption that can be turned into code execution.
2. CVE-2026-109619 – RCE via Stale Global State (Use-After-Free)
   Under certain fatal-error conditions, request-owned internal state can survive after its underlying memory has been freed. A later request handled by the same worker process can then interact with that stale/freed memory.

Both issues stem from how PHP handles abrupt request aborts (“bailouts”) in its core request lifecycle.

How to Fix It

There are no complete mitigations. Updating is the only safe solution.

Apply one of these patched versions immediately: PHP Branch Fixed Version 8.5 8.5.12 8.4 8.4.27 8.3 8.3.36 8.2 8.2.35

Recommended actions:

1. Check your current PHP version (php -v or via your hosting panel).
2. Upgrade to the matching patched release as soon as possible.
3. Restart PHP-FPM / Apache / your web server after the upgrade.
4. If you use distribution packages (Ubuntu, Debian, RHEL, AlmaLinux, Remi, etc.), check your package manager for the security updates and apply them.
5. For managed hosting or cloud platforms, confirm with your provider that the underlying PHP runtime has been patched.
6. After patching, monitor logs and consider rotating secrets (API keys, database credentials, session keys) if the server was internet-facing and unpatched for any significant period.
7. Older unsupported versions (8.1 and below) should be upgraded to a supported branch. Temporary isolation or taking the site offline is safer than leaving them exposed.

Partial temporary measures (not substitutes for patching) mentioned in some advisories include disabling session upload progress (session.upload_progress.enabled=0) and certain other settings, but the PHP security team has stated clearly that these do not fully mitigate the issues.

Bottom Line

These are among the most severe vulnerabilities discovered in PHP in recent years because they affect the runtime itself and require no authentication. Given PHP’s massive footprint across the web, rapid patching is essential.

If you run any PHP-based website or application, treat this as an emergency update. Check your version and apply the fix today.

Stay safe and keep your runtimes updated.