Published 22 October 2026
Two critical remote code execution vulnerabilities have been disclosed in the PHP interpreter, affecting millions of websites worldwide and triggering an emergency out-of-cycle patch release from the PHP security team.
What happened
On October 20, 2026, details of two pre-authentication remote code execution flaws in PHP were leaked ahead of coordinated disclosure. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were subsequently confirmed by the PHP security team, watchTowr, and multiple CERT and vendor advisories.
Both vulnerabilities are rated CVSS v4.0 9.2 (Critical). They have been dubbed PHP2Shell by researchers, reflecting the worst-case outcome: a single web request that gives an attacker a shell on the server. The PHP team released emergency patches on October 21, 2026 at 14:00 UTC, ahead of the originally scheduled disclosure date of October 22.
What the flaws are
CVE-2026-109618 is an out-of-memory corruption bug. When PHP exhausts its configured memory limit during request parsing, it can leave internal data structures only partially initialised. The subsequent cleanup routine then treats that uninitialised memory as valid, allowing an attacker to influence program execution.
CVE-2026-109619 is a use-after-free bug in global interpreter state. If a fatal error interrupts a request before cleanup completes, stale pointers can survive in worker-process memory. A later request handled by the same worker may then read or branch on that freed memory.
Both flaws sit in Zend, the C engine at the heart of PHP, so they are independent of the application code running on top. Updating WordPress, Drupal, or Magento alone does not fix them. The interpreter itself must be patched.
Who is affected
The PHP security team states that all PHP installations serving web requests are affected, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. The team considers mod_php deployments to be at highest risk, with a demonstrated exploit where an unauthenticated request triggers the attack before any application code runs.
Fixed versions are available for the four supported branches: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older are end-of-life and do not receive official fixes from the PHP project. The project has published minimal source backports for PHP 7.4, 8.0, and 8.1 to assist those building from source or without access to an LTS vendor.
CERT-EU and several security vendors have warned that PHP versions from 5.4 onward may be affected. Shodan data cited by Check Point Research shows roughly 884,000 internet-facing hosts advertising PHP 8.1 or older, plus another 740,000 reporting PHP without a version string. Those are banner counts, not confirmed vulnerable systems, but they indicate a large potential exposure.
Why this matters
PHP powers a substantial share of the web, including WordPress, WooCommerce, Drupal, Joomla, Magento, and many hosted and appliance-based products. Because the flaws are in the interpreter rather than in any single application, the attack surface is broad.
The exploitation mechanism is also unusually quiet. CrowdStrike verified that a single anonymous POST request can cause an Apache mod_php worker to launch a shell process and execute an attacker-specified command. The worker does not crash, the server returns a standard HTTP 200 response, and application logs record nothing unusual. That makes post-compromise detection harder than for a typical crash-and-restart exploit.
Cloudflare has deployed emergency WAF rules to all customers, including free plans, and reports observing early attacks. The company stresses that these protections are temporary and that administrators should install the official PHP updates as soon as possible.
What you should do
The PHP security team states plainly that there are no complete mitigations and that updating is the only safe choice. Organisations should:
Inventory every PHP instance, including PHP-FPM pools, container base images, vendor appliances, and hosting control panels. Stage the update path for each platform and schedule a change window around the October 21 release. Patch internet-facing hosts first, then restart PHP-FPM or the web server and verify the running version so the new interpreter actually loads.
Systems on end-of-life PHP versions should be flagged for migration. Where immediate patching is not feasible, CERT-EU advises isolating internet-facing applications from public networks until a fix can be applied. Temporary configuration changes such as disabling session upload progress or restricting multipart request handling reduce exposure to specific attack paths, but they do not make an installation safe.
Administrators should also review web server, WAF, and PHP error logs for unusual activity from August 1, 2026 onward, and hunt for new files in web roots, unexpected child processes spawned by PHP workers, and outbound connections from web servers to unknown destinations.
The bigger picture
This disclosure follows the now-deleted Hacker News post that first named the CVEs and their originally scheduled date. The leak forced the PHP team to move the release forward by one day, compressing the normal head start vendors rely on for testing and deployment.
History suggests the window for safe patching is short. The previous core PHP remote code execution vulnerability, CVE-2024-4577, drew botnet scanning within about 24 hours of disclosure. The same pattern is expected here.
Sources
PHP.net archive, PHP security advisory and release notes, October 21, 2026: https://www.php.net/archive/2026.php
BleepingComputer, “PHP warns admins of two critical flaws, emergency patches coming tomorrow,” October 20, 2026: https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
Sophos, Advisory SA-20261021-php2shell, October 21, 2026: https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell
CERT-EU, Advisory 2026-018, October 21, 2026: https://cert.europa.eu/publications/security-advisories/2026-018/
CrowdStrike, “CrowdStrike Protects Customers from Threats Delivered via PHP2Shell,” October 21, 2026: https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/
Check Point Research, “Patch Now: php2shell,” October 21, 2026: https://blog.checkpoint.com/security/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/
AWS, Security Bulletin 2026-143: https://aws.amazon.com/security/security-bulletins/2026-143-aws/
GitHub php-src security advisories: GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp
How this analysis is researched, sourced and corrected: Editorial standards and corrections. Spotted an error? Contact Philip Hall.
