CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): Patch PHP Now

TL;DR: On 21 October 2026, PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities known together as PHP2Shell. Both are scored CVSS 9.2 and can allow unauthenticated remote code execution on any server handling web requests with PHP. Update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, restart your workers, and verify the version your site actually serves. On PHP 8.1 or older there is no official patched release.

What are these vulnerabilities?

Both bugs live in the PHP engine itself, not in WordPress, Laravel, a plugin, or your code. The vulnerable code runs while PHP parses the request, before your application starts.

CVE-2026-109618 (RCE via OOM corruption). PHP bails out of a request when it runs out of memory. In some paths, request memory is reachable before it is fully initialized. If an allocation fails at that moment, the memory is left in an invalid state that later code can be tricked into trusting. There are several ways to drive PHP to that point during multipart body parsing while staying within configured limits. On Apache mod_php this happens before any application code runs.

CVE-2026-109619 (RCE via stale global state). PHP workers keep global state for errors, sessions, objects, and extensions. Some of that state points to memory owned by one request. After a bad request ending, leftover state can survive into the next request on the same worker and point at freed memory, a use-after-free that can end in code execution.

No authentication, no user interaction, and the attacker gets code execution with the web server account's permissions: config files, database credentials, web shells, the lot.

Who is affected?

Every PHP installation serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Mod_php is rated highest risk. On PHP-FPM, exploitation was confirmed for CVE-2026-109619 through session upload progress, and the CVE-2026-109618 code path is present.

The vulnerable patterns date back to PHP 5.4 era code, and exploitation attempts were observed days before the patch shipped. The technical details also leaked ahead of the planned disclosure.

Fixed versions

Released 21 October 2026:

• PHP 8.2 → 8.2.35
• PHP 8.3 → 8.3.36
• PHP 8.4 → 8.4.27
• PHP 8.5 → 8.5.12

Staying on your current branch is the fastest safe move. Distribution and LTS vendor packages may contain the fix under an older-looking version number, so check your vendor's security notice before trusting the version string alone.

Check the right PHP version

php -v tells you the CLI version. Your site may run a different PHP through PHP-FPM or mod_php. Temporarily drop this in your web root, load it, note the version, and delete the file immediately:

<?php phpinfo();

A phpinfo page left online hands attackers your paths and configuration. Also check staging sites, containers pinned to old image tags, and forgotten installs on the same server. Attackers scan for those first.

Patch steps

1. Inventory every host, container, and hosting account running PHP, with its branch.
2. Update PHP. On Docker, rebuild images on the patched tags and redeploy. On managed hosting, ask your provider to confirm in writing which patched build is running. Updating Composer dependencies does not fix this; it is a runtime update.
3. Restart PHP-FPM and Apache. Running workers keep the old code until they restart.
4. Verify the served version again through the web server.
5. Smoke-test login, forms, and file uploads. The vulnerable paths sit inside multipart and session upload handling.

If you cannot update today

PHP's own position: there is no complete mitigation, and updating is the only safe option. These steps only reduce exposure to confirmed attack paths:

• Set session.upload_progress.enabled = 0 if you do not need upload progress tracking.
• On PHP 8.5, set fatal_error_backtraces = 0.
• Block multipart uploads at the proxy or WAF on routes that do not need them, and restrict admin areas by IP or VPN.
• If an internet-facing system cannot be patched or shielded, several national cyber agencies advised considering taking it offline.

Check whether you were already hit

Patching does not tell you whether someone got in first. Attempts were observed from at least 17 October. Review logs from that date for unusual multipart POSTs, session upload progress hits, abnormal content lengths, and bursts of 500 errors or worker crashes. Check upload and cache directories for recently modified PHP files, look for unknown files in the web root, and new admin accounts or cron jobs. If you find signs, treat it as an incident: preserve logs, rebuild clean, and rotate secrets.

The bigger lesson

Much of this incident's blast radius is servers running PHP versions that stopped receiving fixes years ago. They worked fine until they became the easiest targets on the internet. Keep runtimes inside their supported window, and keep an inventory of everywhere PHP runs.

Have you confirmed your patched version with your hosting provider yet, or are you still waiting?