PHP2Shell: patch PHP now to fix two critical RCE flaws

The PHP project shipped emergency security releases on 21 October for two critical vulnerabilities that can let an attacker run code on a web server without any login. The bugs are tracked as CVE-2026-109618 and CVE-2026-109619 and are being referred to together as PHP2Shell. Both are rated 9.2 (critical) on CVSS 4.0, according to Switzerland's National Cyber Security Centre.

PHP runs a large share of the web, including WordPress, Drupal and Joomla sites, so this is one of the most important server patches of the year.

What is wrong

Both flaws come from the same root problem: when a request ends abnormally, PHP can leave its memory in a broken state.

• CVE-2026-109618 concerns out-of-memory handling. PHP's advisory says some allocations can fail while request memory is not fully set up, and the cleanup code then works with that invalid memory. Several ways of forcing an out-of-memory condition can turn this into remote code execution.
• CVE-2026-109619 is about stale global state: data owned by one request can survive in a worker and be reused by the next request, which can lead to a use-after-free, memory leaks and code execution with the web worker's privileges.

The PHP security team says all installations that serve web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where a demonstrated exploit fires before any application code runs.

Which versions fix it

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. PHP 8.1 and older are out of official support. Some Linux distributions and LTS vendors backport fixes, and the PHP team also published minimal source backports for PHP 7.4, 8.0 and 8.1. Because distributions backport patches, an unchanged version number does not always mean you are vulnerable: check your vendor's security notice.

Are attacks happening?

Before the release, Cloudflare's CTO said the company was already seeing early attacks and had deployed temporary firewall rules. The UK's NCSC told organisations to update immediately or take PHP systems offline until they can be patched. PHP developers stress that mitigations are not a full fix.

What to do now

1. Find every system running PHP, including appliances and admin panels that bundle it.
2. Install the patched release or your vendor's update.
3. Restart PHP-FPM and other long-running workers, and rebuild container images.
4. Check logs for crashes, odd requests or changed files: patching does not undo an earlier compromise.

If you only run a hosted WordPress site, ask your host whether its PHP has been updated. For more on staying safe online, see our pieces on Chrome's new ClickFix warnings and the Meta Muse share-link exposure.