PHP Ships Emergency Patches for Two Critical RCE Flaws Dubbed PHP2Shell

PHP shipped emergency patches on October 21, 2026 for two critical unauthenticated RCE flaws dubbed PHP2Shell, affecting every PHP install that serves web requests.

Sajil Memon

October 22, 2026

PHP shipped emergency security updates on October 21, 2026 for two critical vulnerabilities researchers are calling PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code on a server without authenticating, and both carry a CVSS v4.0 score of 9.2. The fixes landed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, confirmed directly against PHP’s own security advisory and the NVD entry for CVE-2026-109618. Because PHP sits underneath WordPress, WooCommerce, and a large share of the production web, this isn’t a plugin-level bug. It’s the runtime itself.

What PHP2Shell actually breaks

CVE-2026-109618 comes down to how PHP handles out-of-memory errors. PHP uses longjmp() to bail out of the current request when it runs out of memory, but some code paths don’t account for that interruption and leave request data half-initialized. The cleanup routine that runs afterward can then read or branch on that corrupted memory, and under the right conditions that turns into remote code execution.

CVE-2026-109619 is a different flavor of the same family of bug: stale global state. PHP keeps internal pointers into request memory while handling a request, and in some scenarios those pointers aren’t reset properly once the request ends. If a worker process picks up a new request before that state is cleared, it can end up reading memory that was already freed, which again opens the door to RCE.

What makes both of these worse than a typical application vulnerability is where they sit. PHP’s own security team flagged Apache’s mod_php as the highest-risk configuration, with a working exploit that fires before any of your application code even runs. A clean, well-maintained WordPress install doesn’t protect you here, because the flaw is underneath the application layer entirely.

Who’s exposed and what’s patched

Anything that serves PHP over HTTP is in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The fixed versions are:

PHP 8.5.12 (was vulnerable below this)
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35

PHP 8.1 and earlier no longer get official updates from the PHP project, though the security team did publish minimal source backports for 7.4, 8.0, and 8.1 given how severe this is. If your hosting stack runs on one of those older branches, check with your host or Linux distribution directly rather than assuming you’re covered, since some LTS vendors backport fixes under version numbers that don’t look like the ones above.

Exploitation attempts started before the patch even shipped. Cloudflare’s CTO confirmed attackers were already probing both flaws and said the company’s WAF rules were a stopgap, not a fix. Security firm watchTowr reported active exploitation attempts within hours of the 14:00 UTC release. No confirmed breaches have been reported as of this writing, but that window is closing fast given how exposed the affected software is.

What to do if you can’t patch right away

PHP’s security team is explicit that none of this fully protects an unpatched install, patching is the only complete fix. If you genuinely can’t update immediately:

For CVE-2026-109618: set memory_limit=-1 at the FPM pool or Apache config level (not somewhere an app can override it), and keep post_max_size low if the app doesn’t need large uploads.
For CVE-2026-109619: set session.upload_progress.enabled=0 and restart every worker process so the change actually takes.

Both of those close off the confirmed attack paths the PHP team has documented, not every possible variant.

For most of ConicPlex’s clients, the PHP version is set at the hosting account level, not something you configure inside WordPress itself, so the first step is just checking what’s actually running. That’s a gap we see constantly in a WordPress Development audit: sites running fine on the surface while sitting two major PHP versions behind. If your stack is a custom PHP application rather than WordPress, the same patching logic applies through our Web Application Development work. This is also the second critical PHP core patch in under a month, following the FastCGI ACL bypass PHP patched in late September, which is worth keeping in mind if you’re on a hosting plan that doesn’t auto-update PHP point releases.

Sources

Written by

Sajil Memon

Sajil Memon is a co-founder of ConicPlex and a Senior Full Stack Developer focused on backend work: Node.js, PHP, APIs, and the infrastructure decisions that determine whether a system holds up under real traffic. He’s spent years on the side of a project that doesn’t get demoed, the part that has to keep working after launch. He writes here about the technical tradeoffs in backend architecture, deployment, and data handling that only become obvious once something breaks in production.