Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and widely called PHP2Shell, were patched on 21 October 2026. Both carry a CVSS v4.0 score of 9.2. The important detail is where they live: inside the PHP core, not in WordPress plugins, Laravel middleware, or application code.
That means a clean application can still be exposed if the PHP runtime is unpatched. On some setups, especially Apache with mod_php, a crafted request can trigger the issue before any application code runs.
What the bugs do
One vulnerability relates to memory corruption when PHP hits an out-of-memory condition while handling a request. The other involves stale internal state that can survive between requests on the same worker. Researchers demonstrated remote code execution paths, and reports of exploitation attempts appeared after details leaked ahead of the coordinated release.
Affected environments include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Risk is described as highest for mod_php.
Fixed versions
Official safe releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older are end-of-life. Limited source backports exist for 7.4, 8.0, and 8.1, but moving to a supported branch is the clearer long-term path. Distributions and LTS vendors have also shipped packages — check your provider.
What operators should do
Update the PHP runtime to a fixed version and restart the relevant services. That is the only complete fix. Temporary configuration changes (such as disabling session.upload_progress) may reduce exposure but do not replace the patch.
Teams that run infrastructure for many applications — including colocation and managed environments — usually prioritise runtime and platform patches quickly. Facilities designed for high reliability and clear operational processes make it easier to roll out urgent updates without long downtime windows.
If you manage PHP-based systems, treat this as a foundation-level issue. The application layer cannot fully protect you until the runtime itself is current.
