If you run anything that touches PHP, this is one of those “drop everything and check” moments.
On October 21, 2026, the PHP project pushed emergency updates for two serious vulnerabilities: CVE-2026-109618 and CVE-2026-109619. People are calling them “php2shell.” Both score a 9.2 on the CVSS scale, and both can let an attacker run code on your server without logging in.
These aren’t bugs in WordPress plugins or some random library. They’re in the PHP runtime itself — the thing that sits under pretty much every PHP site on the internet.
What actually went wrong?
One of the flaws (CVE-2026-109618) has to do with how PHP handles running out of memory. If an attacker can force a worker into an out-of-memory situation at just the right moment, the cleanup code can end up treating half-baked internal data as if it’s valid. That opens the door to remote code execution.
The other one (CVE-2026-109619) is about leftover state. Sometimes request-related data sticks around after the memory behind it has already been freed. The next request that lands on the same worker can trip over that stale data and, again, execute code.
The risk is highest on Apache with mod_php — researchers showed an unauthenticated request can trigger the attack before your application code even runs. But PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed setups are also in the blast radius.
There’s also a related issue (CVE-2026-115560) tied to session upload progress. Until the next regular release, the PHP team is recommending you turn that feature off (session.upload_progress.enabled = 0).
Who needs to worry?
Basically anyone running PHP that serves web requests and hasn’t updated yet.
Here are the fixed versions:
- PHP 8.5 → 8.5.12
- PHP 8.4 → 8.4.27
- PHP 8.3 → 8.3.36
- PHP 8.2 → 8.2.35
If you’re still on PHP 8.1 or older, you’re on end-of-life versions. The PHP project didn’t ship official fixes for those, though some Linux distributions have put out limited backports. Running unsupported PHP right now is a bad idea.
Why this one hits hard
Because the bugs live so deep in the runtime, a lot of the usual protections don’t help. Your framework’s middleware, input filtering, or even a web application firewall won’t fully stop these. If someone successfully exploits it, they can run code as the web server process. That’s game over for a lot of setups.
Exploitation attempts started showing up quickly after the details became public. Researchers have confirmed real remote code execution is possible under common configurations. So far it doesn’t look like the internet is on fire with successful mass compromises, but the window is still open for anyone who hasn’t patched.
What you should do right now
- Find every PHP instance you have.
Check your web servers, containers, managed hosting, control panels, and any appliance that might quietly be running PHP. It’s easy to miss some of them. - Update.
Get to one of the fixed versions listed above. Prioritize anything that’s internet-facing. The PHP security team has been pretty clear: updating is the only complete fix. - If you can’t patch immediately:
- Set session.upload_progress.enabled = 0
- Consider taking non-critical public-facing PHP apps offline until you can update
- Keep an eye on logs for weird requests, especially anything that looks like it’s trying to burn memory or poke at upload progress features
- Double-check after you update.
Confirm the running version and watch for anything unusual — unexpected processes, new files, weird outbound traffic.
The bigger picture
This is another reminder that the foundation layers of the web still matter a lot. Language runtimes and long-running infrastructure components can carry serious bugs for a long time. Staying on supported, regularly updated PHP versions isn’t glamorous, but it’s necessary.
The PHP team moved fast once the issues became public, and a bunch of researchers and partners helped coordinate the response. Still, because PHP is so widespread, a lot of sites are going to stay exposed for a while.
If you run PHP, treat this as high priority. Check your versions, get the updates on, and verify. Better to deal with it this weekend than clean up after something worse later.