PHP2Shell: two critical RCE flaws get emergency patches in PHP 8.x

Two flaws, one root cause

On 21 October 2026, PHP’s security team rushed out fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, bundled together under the name PHP2Shell. Both allow remote code execution without authentication, with the privileges of whatever account runs your web server. They were found by researchers at Calif, Wiz and OpenAI, as Bleeping Computer reports.

The two share a root cause: when a request ends badly, PHP can leave its memory in a corrupted state. The first flaw chains several weaknesses together to trigger corruption tied to memory exhaustion. The second leans on stale global state and opens the door to a heap use-after-free, a memory disclosure and, at the end of the chain, code execution.

Every setup that serves web requests is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates mod_php as the riskiest of the lot, with a demonstrated exploit in which an unauthenticated request fires the attack before your application code even gets a turn.

The versions to install

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the project; some distributions and LTS vendors backport fixes, which you will need to confirm with them. Given the severity, the security team has nonetheless published minimal source-code backports for PHP 7.4, 8.0 and 8.1, aimed at people who compile their own builds or have no LTS vendor to lean on. If you are still running PHP 7, the advice has not changed: migrate to a fixed version.

The day before, on Tuesday, PHP’s developers had already sounded the alarm: every user should be ready to update the moment the patches landed, and the team reserved the right to publish early if details leaked or active exploitation was spotted. Even before the release, Cloudflare’s chief technology officer confirmed the company was seeing the first attacks against both flaws, despite WAF rules deployed to block the known exploitation methods, protections he himself described as temporary. The UK’s NCSC recommends updating immediately or pulling systems offline until they are patched.

What you can do in the meantime

For servers you cannot update right away, the PHP team has listed measures that reduce exposure to some attack paths without protecting you fully. A member of PHP’s core team put it bluntly: no mitigation blocks the attacks entirely, and only the official fix is a permanent defence.

For CVE-2026-109618: set memory_limit to -1, preferably in a way applications cannot override, via php_admin_value in the FPM pool or the Apache configuration; lower post_max_size to 8M if the application does not accept file uploads, 32M otherwise; set a container or cgroup limit as an availability bound, ideally with a policy that only kills the affected worker.

For CVE-2026-109619: set session.upload_progress.enabled to 0 and restart all workers; on PHP 8.5, set fatal_error_backtraces to 0 and restart, which only closes the confirmed fatal-error backtrace path; remove any invalid or deprecated per-request settings that emit diagnostics before initialisation. Hiding those diagnostics with error_reporting, display_errors or the @ operator achieves precisely nothing. Finally, fix the fatal errors and timeouts an attacker can reach, including in callbacks, upload or import handling and cleanup routines.

The order of business

If you run PHP servers, the sensible sequence this 21 October comes in four steps: inventory the versions in production, update everything on 8.2 or newer, contact your distribution vendor for the rest, and apply the mitigations only to whatever genuinely has to wait. The scale justifies the effort: PHP powers 75 to 80% of websites, including everything on WordPress, Joomla and Drupal, and VirusTotal puts the number of PHP hosts exposed online at over 5.1 million, roughly 3.8 million of them with at least one open port.

The PHP team had given itself until the first confirmed exploitation to ship ahead of schedule. Judging by the attacks Cloudflare logged before the patches landed, that window slammed shut in under a day. Yours closes when you update.