Two critical security vulnerabilities discovered in PHP have triggered an urgent security response, with developers and system administrators being urged to update their PHP installations immediately. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities could allow attackers to execute arbitrary code on vulnerable servers without authentication.
The vulnerabilities, collectively referred to as PHP2Shell, affect PHP installations that process web requests and pose a particularly serious risk to internet-facing applications. The PHP development team released security updates on October 21, 2026.
What Happened?
On October 20, 2026, the PHP development team announced an upcoming emergency security release addressing two critical vulnerabilities. The announcement urged developers and administrators to prepare for immediate updates.
The following day, the team released patched versions of PHP to address both issues.
Each vulnerability received a CVSS v4.0 score of 9.2 out of 10, indicating a critical security risk.
The vulnerabilities are particularly concerning because successful exploitation may allow an unauthenticated attacker to execute malicious code remotely. Depending on the server’s configuration and permissions, this could expose sensitive information, compromise application data, or provide a foothold for further attacks.
The PHP team has identified Apache deployments using mod_php as especially vulnerable because a demonstrated attack can trigger the issue before application code executes. However, other PHP server configurations are also affected.
Understanding the Two Vulnerabilities
Although both vulnerabilities can lead to remote code execution, they originate from different problems in PHP’s internal memory management.
1. CVE-2026-109618: Remote Code Execution Through Memory Allocation Failure
The first vulnerability involves how PHP handles out-of-memory conditions.
When PHP encounters a memory allocation failure, it may interrupt request processing while internal request data is only partially initialized. During subsequent cleanup, PHP may incorrectly treat that incomplete data as valid.
An attacker who can trigger this condition through a specially crafted request may be able to exploit the resulting memory corruption.
The potential consequences include:
- Remote code execution on a vulnerable server.
- Exposure of sensitive application data.
- Compromise of the affected application’s security.
The issue is particularly serious because it concerns PHP’s internal request-handling mechanisms rather than a vulnerability confined to a specific application framework.
2. CVE-2026-109619: Remote Code Execution Through Stale Memory References
The second vulnerability involves stale internal state and memory that has already been freed.
In this case, request-related internal state may persist after the memory backing it has been released. A subsequent request handled by the same worker can potentially access that stale state before PHP properly reinitializes it.
This type of flaw is commonly associated with a use-after-free vulnerability.
Use-after-free bugs occur when software continues to access memory after that memory has been released. Depending on the circumstances, this can cause crashes, memory corruption, information disclosure, or arbitrary code execution.
In PHP’s case, exploitation of the vulnerability could allow an attacker to execute code remotely on an affected server.
Which PHP Versions Are Affected?
The PHP security team has released fixes for the following versions:
- Branch: PHP 8.5.x, Fixed Version: 8.5.12
- Branch: PHP 8.4.x, **Fixed Version: 8.4.27**
- Branch: PHP 8.3.x, Fixed Version: 8.3.36
- Branch: PHP 8.2.x, Fixed Version: 8.2.35
Administrators should upgrade to the corresponding patched version or install an appropriate security update supplied by their operating system or PHP vendor.
PHP 8.1 and older versions no longer receive security updates directly from the PHP project. Some Linux distributions and long-term support vendors may provide backported fixes, so organizations running these versions should verify their vendor’s guidance.
The vulnerabilities may affect several PHP deployment models, including:
- PHP-FPM
- Apache with
mod_php php-cgi- FrankenPHP
- LiteSpeed
Organizations should also check third-party products, containers, appliances, and services that bundle PHP, even when PHP is not directly visible to the application’s developers.
How Developers and System Administrators Should Respond
The PHP development team recommends immediate updates, emphasizing that configuration changes are not a complete substitute for applying the security patches.
Organizations should prioritize the following actions.
1. Identify PHP Installations
Start by identifying all systems running PHP, particularly internet-facing servers and applications that process untrusted input.
For example, administrators can check the PHP CLI version by running:
php -vHowever, this command only reports the version of the PHP CLI executable. The version used by PHP-FPM, Apache, containers, or other application environments should also be verified.
2. Apply the Security Updates
Upgrade to the appropriate patched PHP release.
For example, a system running PHP 8.4 should be upgraded to PHP 8.4.27 or a later release containing the relevant fixes.
Before deploying the update, teams should review their operating system’s package repositories, hosting environment, and deployment procedures.
After upgrading, restart the relevant PHP workers or services as necessary to ensure that the patched runtime is actually being used.
3. Review Third-Party Dependencies and Infrastructure
Updating the main PHP installation may not be sufficient if other components bundle their own PHP runtime.
Development and infrastructure teams should review:
- Docker images and container registries.
- Managed hosting environments.
- Application appliances and third-party services.
- CI/CD pipelines and deployment configurations.
- Legacy applications running unsupported PHP versions.
Organizations should also confirm that production environments use the expected PHP version rather than relying solely on local development environments.
4. Monitor for Potential Compromise
Because the vulnerabilities can permit remote code execution, administrators should investigate suspicious activity around the time of exposure.
Useful areas to review include:
- Web server and application logs.
- Unexpected processes launched by PHP workers.
- Unusual outbound network connections.
- Unexpected files or changes to application code.
- Suspicious authentication activity or newly created accounts.
Applying a security update prevents exploitation through the patched vulnerabilities, but it does not automatically reverse a compromise that may have occurred before the update.
If immediate patching is not possible, organizations should consider isolating exposed applications from public networks until remediation is complete.
Why This Matters Beyond PHP Developers
PHP remains widely used in websites, content management systems, e-commerce platforms, and backend applications.
Consequently, a vulnerability in the PHP runtime can affect organizations even when their application code does not contain an obvious security flaw.
This incident also highlights an important distinction between application-level security and runtime security.
Developers often focus on input validation, authentication, authorization, and dependency updates. These remain essential practices, but vulnerabilities in the underlying runtime can introduce risks that application-level protections alone cannot eliminate.
In particular, the mod_php attack path demonstrates why organizations must keep their language runtimes and server infrastructure updated, rather than assuming that secure application code is sufficient.
Conclusion
The PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, represent a serious security concern because they can allow unauthenticated remote code execution on vulnerable PHP servers.
The PHP development team has released patched versions, and organizations should prioritize identifying affected installations, applying the appropriate updates, and investigating any signs of compromise.
For developers, the key lesson is straightforward: application security does not end with the application itself. Keeping the runtime, infrastructure, and dependencies up to date is an essential part of protecting production systems.
Recommended action: Review the official PHP security advisory for the latest technical details and upgrade guidance.