Overview
The PHP security team released emergency patches on October 21, 2026 for two critical remote code execution vulnerabilities tracked together as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both are unauthenticated and stem from PHP leaving memory in a corrupted state when a request ends abnormally.
The flaws were found by researchers from Calif, Wiz, and OpenAI. Krebs on Security warned that the patch may cause site outages as roughly 70 percent of websites scramble to update core software.
The Vulnerabilities
| CVE | Description |
|---|---|
| CVE-2026-109618 | RCE as the web worker account via a chain of weaknesses that trigger out-of-memory corruption |
| CVE-2026-109619 | Stale global state enabling unauthenticated heap use-after-free, memory disclosure, and RCE |
Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team considers mod_php the highest risk: a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs.
Exploitation Status
Cloudflare's CTO said the company was already seeing early attacks against both flaws before the patches shipped, and deployed temporary WAF rules for known exploitation methods. The UK NCSC urged organizations to update immediately or take affected systems offline. VirusTotal estimates more than 5.1 million PHP hosts are exposed online.
Fixed Versions
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older no longer receive upstream updates. The PHP team published minimal source backports for 7.4, 8.0, and 8.1 for those building from source, and some distributions and LTS vendors ship their own backports, so check with your vendor.
Partial Mitigations
Patching is the only full fix. Until then:
CVE-2026-109618
- Set
memory_limit=-1, ideally viaphp_admin_valueso applications cannot override it - Set a low
post_max_size(8M without uploads, 32M with) - Apply a container or cgroup limit that kills only the affected worker
CVE-2026-109619
- Set
session.upload_progress.enabled=0and restart all workers - On PHP 8.5, set
fatal_error_backtraces=0and restart workers - Fix attacker-reachable fatal errors and execution timeouts
Hiding errors with error_reporting, display_errors, or @ does not help.
Recommended Actions
- Upgrade to a fixed PHP release now, prioritizing mod_php and internet-facing hosts
- Restart all PHP workers after patching
- Apply the interim settings above where patching must wait
- Review web logs for anomalous requests and worker crashes since October 20
- Migrate off unsupported PHP branches