Emergency PHP Release for Two Critical Flaws
The PHP security team announced on October 20, 2026 that it would ship an out-of-cycle security release at 14:00 UTC on October 21 to fix two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2 and are described as unauthenticated, meaning an attacker who can reach a PHP application over the network could potentially execute code as the PHP process without logging in.
Information about the flaws reportedly leaked ahead of the scheduled disclosure, and a proof-of-concept tool dubbed PHP2Shell has surfaced. The incident has been nicknamed "PHP2Shell" after that tool.
What Is Known
| Attribute | Detail |
|---|---|
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Severity | CVSS v4.0 9.2 (critical) |
| Impact | Unauthenticated remote code execution (potential) |
| Patch release | October 21, 2026, 14:00 UTC |
| Public exploit status | PoC tool "PHP2Shell" circulating; watchTowr says it reproduced CVE-2026-109618 |
Reporting disagrees on scope. Sansec says the flaws affect web servers running PHP 5.4 or later and expects mass exploitation within minutes of the patch drop. Other coverage says supported branches 8.2 through 8.5 will receive fixes, while end-of-life branches (8.1 and earlier, 7.x, 5.x) will not get official patches. Some researchers rate the bugs higher than PHP's own 9.2 score.
Unconfirmed community analysis points to memory-safety bugs in the session.upload_progress handling, reachable through crafted multipart/form-data POST requests. PHP had not published root causes or exact affected ranges at the time of writing, so treat this detail as preliminary.
Recommended Actions
- Patch immediately once the fixed releases appear on php.net; check the official advisory for exact versions.
- Inventory PHP exposure, including legacy and end-of-life hosts, CMS platforms, and containers with bundled PHP.
- Apply interim mitigations where patching is delayed: disable session upload progress if unused, and consider WAF or web-server rules that block or restrict multipart POST requests to PHP endpoints. A community Apache rule set exists for this purpose.
- Hunt for compromise after patching: new web shells, unexpected child processes of PHP-FPM or the web server, and outbound connections from web hosts.
- Plan migrations for any end-of-life PHP versions, which will remain exposed.
Why It Matters
PHP runs a very large share of the web, including WordPress, Magento, and countless custom applications. A pre-authentication RCE with a public proof of concept and a leaked disclosure window gives attackers a head start over defenders, and mass scanning is likely to begin as soon as patches reveal the fix.