On October 21, 2026, the PHP project shipped emergency releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws in the PHP engine itself: CVE-2026-109618 and CVE-2026-109619, together dubbed PHP2Shell. Both are rated CVSS v4.0 9.2 by the PHP security team and can allow unauthenticated remote code execution, independent of the application running on top. Wiz says every PHP version released in the last decade, back to PHP 5.4, is affected by at least one of the issues, and exploitation attempts were already hitting sensors as the patches landed. Since PHP sits underneath WordPress, Drupal, Joomla, Magento, Laravel and countless internal apps, this is a patch-today event for anyone running web servers. Here’s what the two bugs are, who is exposed, and exactly how to fix or mitigate them.
The Two CVEs
- CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), RCE via OOM corruption: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid. According to the PHP Foundation, on Apache with mod_php an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. RCE was also confirmed on PHP-FPM through application-level code paths.
- CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), RCE via stale global state: Request-owned internal state, such as error, session, object and extension state, can survive after its backing memory is freed. A later request handled by the same worker may use that stale state before normal initialization resets it, a use-after-free. The PHP Foundation says the reporter demonstrated RCE against a real-world application on Apache with mod_php, and PHP’s advisory also lists memory disclosure as a confirmed impact.
As the PHP Foundation explained, “Both issues sit in parts of PHP that nearly every request touches: memory management and error handling.” Wiz warns that the memory disclosure angle can expose passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself, a risk it compares to Heartbleed.
Who Is Affected
According to php.net, the at-risk group is “all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed,” with risk highest for mod_php. Affected and fixed versions, per the PHP advisories and Tenable’s analysis:
- PHP 8.5: Versions before 8.5.12 are vulnerable; fixed in 8.5.12.
- PHP 8.4: Versions before 8.4.27; fixed in 8.4.27.
- PHP 8.3: Versions before 8.3.36; fixed in 8.3.36.
- PHP 8.2: Versions before 8.2.35; fixed in 8.2.35. PHP 8.2 reaches end of life on December 31, 2026.
- PHP 7.4 through 8.1: No official releases, but the PHP security team published minimal source backports for people building from source. Some distributions and LTS vendors provide backported packages.
- PHP 5.4 through 7.3: End of life with no fix from the PHP project. Upgrade.
Exploitation Status
The CVE identifiers leaked on October 20, and the PHP Foundation says it moved the release up by a day as a result. Since then:
- watchTowr says it has reproduced both vulnerabilities and saw the first in-the-wild exploitation attempts hit its sensors as patches landed, though it had not observed successful attempts. “Whilst nobody has been successful to date, we don’t expect that will last long,” said Jake Knott, watchTowr’s head of threat intelligence.
- Hadrian reported, hours before the fixes shipped, that it was “seeing php2shell exploited in the wild at scale,” mostly abusing PHP’s session upload-progress path.
- Cloudflare CTO Dane Knecht said the company is “seeing early attacks emerging” and has deployed WAF rules for known vectors to all customers, including the free tier, calling them “a STOPGAP only.”
- Public PoCs: Code claiming to exploit the flaws is circulating. The PHP Foundation said its team “did not identify any functional exploits at the time of release/public disclosure,” and Tenable warns unverified exploit code can be laced with malware.
Calif says it confirmed pre-authentication RCE against specific versions of WordPress, Drupal, Joomla and Magento. The flaws were reported to PHP by Calif, OpenAI and Wiz, which say AI models played a significant role in turning a long-known out-of-memory weakness into a working exploit.
How to Fix It
The PHP project is blunt: “There are no complete mitigations, updating is the only safe choice.” For admins, that means:
- Inventory first: Find every PHP runtime you own, including web servers, containers, base images, control panels, appliances and vendor products that bundle PHP. Run php -v on hosts and check package versions; vulnerability scanners already have checks for the fixed builds.
- Patch from your vendor: Linux distributions and LTS vendors received patches in advance, so check your distro’s security advisories for updated packages. Otherwise, build or download 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from php.net (Windows binaries are on the same downloads page).
- Remi repo users: The PHP project says the volunteer-maintained rpms.remirepo.net “will not have updates today” and urges users to switch to distribution packages or build from source.
- Restart everything: Restart Apache, every PHP-FPM pool and any long-running workers so the patched engine is actually loaded. Rebuild and redeploy container images rather than patching running containers.
- Cloud platforms: Google Cloud says supported App Engine standard runtimes are patched automatically, but Cloud Run images without automatic base image updates, GKE workloads and custom runtimes must be rebuilt and redeployed.
- Legacy versions: For 8.1 and older, apply a vendor backport or the PHP team’s source backports for 7.4–8.1, and schedule an upgrade to a supported branch.
If You Can’t Patch Today
PHP lists interim measures that “reduce exposure to specific attack paths but do not make an installation safe.” Restart every worker after any change.
- For CVE-2026-109618: Set memory_limit=-1 in a way applications can’t override (for example php_admin_value in the FPM pool or Apache config). Set a low post_max_size (8M if uploads aren’t needed, 32M if they are) with upload_max_filesize below it, and enforce request size and field-count limits at the web server or proxy. Use container or cgroup memory limits as an availability boundary, but do not substitute RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable path.
- For CVE-2026-109619: Set session.upload_progress.enabled=0 in php.ini, the FPM pool or server config (not ini_set() or .user.ini). On PHP 8.5, also set fatal_error_backtraces=0. Remove invalid or deprecated per-request settings that emit diagnostics, and fix attacker-reachable fatal errors and timeouts.
- Edge protection: Put internet-facing PHP apps behind a WAF with PHP2Shell rules, and consider isolating them from public networks until patched, as CERT-EU recommends.
- Hunt for compromise: Watch for repeated PHP worker crashes, unusual upload-progress requests and new web shells or unexpected files in web roots, and rotate secrets on any server you suspect was exposed, given the memory disclosure risk.
Looking Ahead
PHP2Shell lands squarely in the category of vulnerabilities that defenders will be talking about for years. It lives in the runtime rather than in any one application, it touches code paths nearly every request uses, and it reaches back more than a decade of releases. With exploitation attempts already in progress and PoCs circulating, the window between disclosure and mass exploitation is likely to be short.
It is also a preview of the AI era of vulnerability research. Wiz and Calif both credit frontier AI models with making a long-known weakness practically exploitable, and the same tools are available to attackers. For techs, the lesson is the same one Log4Shell taught: know where your runtimes live, patch fast, and restart everything. Then go find the PHP you forgot you had.
Sources:
- PHP.net security advisory and release announcements, October 21, 2026
- PHP GitHub Security Advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, October 21, 2026
- The PHP Foundation, October 21, 2026
- Wiz Research, October 21, 2026
- Tenable, October 21, 2026
- SecurityWeek, October 21, 2026
- Google Cloud Blog, October 21, 2026
