PHP shipped emergency security updates on October 21, 2026 for two critical vulnerabilities researchers are calling PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code on a server without authenticating, and both carry a CVSS v4.0 score of 9.2. The fixes landed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, confirmed directly against PHP’s own security advisory and the NVD entry for CVE-2026-109618. Because PHP sits underneath WordPress, WooCommerce, and a large share of the production web, this isn’t a plugin-level bug. It’s the runtime itself.
What PHP2Shell actually breaks
CVE-2026-109618 comes down to how PHP handles out-of-memory errors. PHP uses longjmp() to bail out of the current request when it runs out of memory, but some code paths don’t account for that interruption and leave request data half-initialized. The cleanup routine that runs afterward can then read or branch on that corrupted memory, and under the right conditions that turns into remote code execution.
CVE-2026-109619 is a different flavor of the same family of bug: stale global state. PHP keeps internal pointers into request memory while handling a request, and in some scenarios those pointers aren’t reset properly once the request ends. If a worker process picks up a new request before that state is cleared, it can end up reading memory that was already freed, which again opens the door to RCE.
What makes both of these worse than a typical application vulnerability is where they sit. PHP’s own security team flagged Apache’s mod_php as the highest-risk configuration, with a working exploit that fires before any of your application code even runs. A clean, well-maintained WordPress install doesn’t protect you here, because the flaw is underneath the application layer entirely.
Who’s exposed and what’s patched
Anything that serves PHP over HTTP is in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The fixed versions are:
- PHP 8.5.12 (was vulnerable below this)
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and earlier no longer get official updates from the PHP project, though the security team did publish minimal source backports for 7.4, 8.0, and 8.1 given how severe this is. If your hosting stack runs on one of those older branches, check with your host or Linux distribution directly rather than assuming you’re covered, since some LTS vendors backport fixes under version numbers that don’t look like the ones above.
Exploitation attempts started before the patch even shipped. Cloudflare’s CTO confirmed attackers were already probing both flaws and said the company’s WAF rules were a stopgap, not a fix. Security firm watchTowr reported active exploitation attempts within hours of the 14:00 UTC release. No confirmed breaches have been reported as of this writing, but that window is closing fast given how exposed the affected software is.
What to do if you can’t patch right away
PHP’s security team is explicit that none of this fully protects an unpatched install, patching is the only complete fix. If you genuinely can’t update immediately:
- For CVE-2026-109618: set
memory_limit=-1at the FPM pool or Apache config level (not somewhere an app can override it), and keeppost_max_sizelow if the app doesn’t need large uploads. - For CVE-2026-109619: set
session.upload_progress.enabled=0and restart every worker process so the change actually takes.
Both of those close off the confirmed attack paths the PHP team has documented, not every possible variant.
For most of ConicPlex’s clients, the PHP version is set at the hosting account level, not something you configure inside WordPress itself, so the first step is just checking what’s actually running. That’s a gap we see constantly in a WordPress Development audit: sites running fine on the surface while sitting two major PHP versions behind. If your stack is a custom PHP application rather than WordPress, the same patching logic applies through our Web Application Development work. This is also the second critical PHP core patch in under a month, following the FastCGI ACL bypass PHP patched in late September, which is worth keeping in mind if you’re on a hosting plan that doesn’t auto-update PHP point releases.
Update – October 23, 2026
PHP flagged a third, related issue two days after the PHP2Shell patches above shipped: CVE-2026-115560, described in an informational advisory on php.net dated October 23, 2026. It’s a separate bug from CVE-2026-109618 and CVE-2026-109619, and the October 21 releases do not fix it.
The trigger is narrow. An application has to set session.serialize_handler to php_binary or php_serialize in its configuration, then switch it to php at runtime with ini_set() before calling session_start(), with session upload progress still enabled. PHP says that combination is unlikely in real-world code, which is why it’s handling this through the regular release cycle instead of an emergency patch, and hasn’t yet published affected version ranges or a severity score.
The fix for now is the same setting already listed above for CVE-2026-109619: session.upload_progress.enabled=0. If you applied that setting after the October 21 patch, PHP says no further action is needed. A full advisory for CVE-2026-115560 is expected with PHP’s next regular release.
Sources
- PHP.net security advisory, “Critical remote code execution vulnerabilities, update now”
- NVD: CVE-2026-109618
- NVD: CVE-2026-109619
- PHP.net archive: informational advisory on CVE-2026-115560 (Oct 23, 2026)
- BleepingComputer: “PHP ships emergency patches for critical PHP2Shell flaws”
- The Hacker News: “PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge”
