PHP Vulnerability CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): How to Patch Your Server Today

A critical PHP remote code execution vulnerability lets unauthenticated attackers run code on your server. Here is what happened, which PHP versions are affected, and exactly how to fix it.

---

On October 21, 2026, the PHP team shipped an emergency security release for a critical PHP vulnerability affecting millions of websites: two flaws in the PHP core itself that allow remote code execution (RCE). Both are tracked as CVE-2026-109618 and CVE-2026-109619, both score 9.2 on CVSS v4.0, and together they are being called PHP2Shell.

If you run anything on PHP (WordPress, Laravel, Drupal, a custom app), this is a "drop what you're doing" patch.

What happened

• Oct 20: The PHP security team pre-announced a critical release for the next day.
• Oct 21 (14:00 UTC): Fixed versions were released.
• Wiz Research reported the bugs together with Calif and OpenAI, as part of OpenAI's "Patch the planet" initiative.
• Cloudflare reported early attack attempts on the morning of Oct 21, before the fix landed.

Because the flaws sit in PHP itself, they are independent of your application. A fully patched WordPress site on an unpatched PHP runtime is still exposed.

The bugs, in plain English

Both CVEs describe the same underlying mistake from two angles: PHP keeps some long-lived global state that points to memory belonging to a single request. If that memory is freed (for example after an out-of-memory error) and a later request trusts the stale pointer, you get a use-after-free.

• CVE-2026-109618: Out-of-memory handling can interrupt PHP while request data is only half-initialized, and cleanup then treats the broken data as valid.
• CVE-2026-109619: Request-owned state survives after its memory has been freed. This includes saved fatal-error backtraces on PHP 8.5 and shared OPcache state across workers.

According to JFrog's analysis, one exploit path abuses PHP's session upload-progress feature, which handles multipart uploads and is enabled by default. An attacker controls parts of the data PHP decodes before any of your code runs. The result can be remote code execution or a Heartbleed-style memory leak.

Who is affected

• PHP versions from 5.4 through 8.5.11 are affected, per Wiz.
• Fixed in: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• PHP 8.1 and older are affected too unless your OS vendor has backported the fix.
• Highest risk: Apache with mod_php, where the flaw can fire before your application even loads. PHP-FPM is also susceptible. FrankenPHP and LiteSpeed setups should be treated as at risk.

What to do right now

1. Upgrade PHP to one of the fixed versions, or install your distro's patched package.
2. Restart everything (PHP-FPM, Apache, workers). A patched binary that is not restarted protects nothing.
3. Rebuild containers. Base images need the new PHP, and running containers do not update themselves.
4. On shared hosting? Ask your host in writing whether and when they patched.
5. Check your version: php -v

If you truly cannot patch yet

PHP's advisories describe partial mitigations. Treat these as stopgaps only:

• Set session.upload_progress.enabled = 0 and restart PHP. This blocks one attack path.
• On PHP 8.5, also set fatal_error_backtraces = 0.
• Removing the PHP memory limit narrows CVE-2026-109618 but trades away resource-exhaustion protection, so you need a server-level limit in its place.

None of these closes the bugs completely. Patching does.

A warning about fake exploits

Whenever a big CVE drops, GitHub fills up with "PoCs." JFrog found fake ones that look like malware loaders but are pranks. Others will be real malware. Do not run exploit code you found on a random repo, especially not on a machine that matters.

Takeaways

• Language-runtime bugs bypass every app-level defense you have. WAF rules and plugin hardening are not a substitute for patching the runtime.
• Pre-announcements are a head start. The gap between "a critical fix is coming" and "details are public" was about a day here.
• Keep an inventory of where PHP runs (servers, containers, CI images). You cannot patch what you cannot find.

FAQ: PHP2Shell vulnerability

What is PHP2Shell? PHP2Shell is the public name for CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP runtime that can allow unauthenticated remote code execution.

Which PHP versions are vulnerable? PHP 5.4 through 8.5.11 are affected. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Is my WordPress site affected? Yes, if the server runs an unpatched PHP version. The flaw is in PHP itself, so WordPress plugins and themes cannot protect you. Update PHP through your host or control panel.

How do I check my PHP version? Run php -v on the server, or check the PHP version setting in your hosting panel.

Is the vulnerability being exploited? Cloudflare reported early attack attempts on the morning of October 21, before the fix was released, so treat patching as urgent.

Sources

• PHP security advisories: GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp (php/php-src on GitHub)
• JFrog Security Research, "PHP2Shell: All You Need to Know" (research.jfrog.com)
• Google Cloud / Wiz, "Responding to core PHP vulnerabilities" (cloud.google.com/blog)
• Codeable, "PHP Security Release on 21 October 2026" (codeable.io/blog)
• Cisco Security Advisory cisco-sa-php-october26-Jj384Daq
• runZero, "Critical RCE vulnerability in PHP: Find impacted assets" (runzero.com/blog/php)