PHP ships emergency patches for critical PHP2Shell flaws

Two unauthenticated remote code execution vulnerabilities affect all PHP web installations; administrators urged to patch immediately

By LineZotpaper

Published21 October 2026

Read Time2 min

The PHP security team has released emergency security patches for two critical remote code execution (RCE) vulnerabilities, collectively named PHP2Shell, that affect all PHP installations serving web requests. The flaws, discovered by researchers from Calif, Wiz, and OpenAI, allow unauthenticated attackers to achieve code execution with web worker privileges. The PHP team stated that the highest risk is for servers using mod_php, where an exploit can be triggered before any application code runs.

The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from the same underlying issue: PHP can leave its memory in a corrupted state when a request ends abnormally. CVE-2026-109618 involves a chain of weaknesses that lead to out-of-memory corruption, allowing remote code execution as the web worker account. CVE-2026-109619 is a stale global state vulnerability enabling unauthenticated heap use-after-free, memory disclosure, and remote code execution with the web worker's privileges.

Affected versions include all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP security team has released patches as versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 for the 8.x branch. For older versions, including PHP 7.4, 8.0, and 8.1, the team provided minimal source-backports for those building from source or without access to an LTS vendor.

Advanced warning was given on Tuesday, urging administrators to prepare for the updates. Gina Peter Banyard, a PHP core developer, warned that no mitigation measures would fully block potential attacks and that patching is the only permanent defense.

Before the patches were released, Cloudflare CTO Dane Knecht confirmed early exploitation attempts targeting the vulnerabilities. The UK National Cyber Security Centre (NCSC) also warned organisations to immediately update systems using PHP or take them offline until patched.

For those unable to patch immediately, the PHP security team shared temporary mitigation measures, though they stressed that these do not fully protect against exploitation.

Analysis

Why This Matters

PHP powers the majority of websites globally, making these critical RCE vulnerabilities a significant threat to internet infrastructure.
Both flaws can be exploited without authentication, allowing attackers to execute code on affected servers.
Early attacks have been observed, and the only permanent defense is applying the official patches.

Background

PHP is an open-source, server-side scripting language used by an estimated 75% to 80% of all websites, including those running content management systems like WordPress, Joomla, and Drupal. According to VirusTotal, over 5.1 million PHP hosts are exposed online, with roughly 3.8 million having at least one port open. The PHP2Shell vulnerabilities stem from memory corruption triggered when PHP requests end abnormally. They were discovered through collaboration between researchers from Calif, Wiz, and OpenAI.

Key Perspectives

PHP Security Team: Released patches after providing an advanced warning and emphasized that mitigation measures are insufficient; patching is the only permanent defense. Cloudflare: CTO Dane Knecht confirmed early exploitation attempts and deployed temporary WAF rules, but stressed that administrators must apply the official patches. UK NCSC: Warned UK organisations to update systems immediately or take them offline until they can be patched.

What to Watch

Adoption rate of patches across the PHP ecosystem; delays could lead to widespread exploitation.
Reports of active exploitation campaigns, particularly targeting unpatched servers.
Potential for the vulnerabilities to be used in ransomware or botnet operations.

Sources

PHP ships emergency patches for critical PHP2Shell flaws · BleepingComputer

Checked

12 claims in this story checked against 1 source: 12 supported.

Show each claim

SupportedPHP has shipped emergency patches for critical flaws collectively named PHP2Shell.BleepingComputer: “The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities ( CVE-2026-109618 and CVE-2026-109619 ) tracked collectively as PHP2Shell.”
SupportedThe vulnerabilities affect all PHP installations that serve web requests.BleepingComputer: “The two unauthenticated RCE flaws were discovered by Calif , Wiz , and OpenAI security researchers, and affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.”
SupportedAdministrators are urged to patch immediately.BleepingComputer: “The UK National Cyber Security Centre (NCSC) has also warned UK organizations to immediately update systems using PHP or take them offline until they can be patched.”
SupportedThe PHP security team released patches for two critical remote code execution vulnerabilities.BleepingComputer: “The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities ( CVE-2026-109618 and CVE-2026-109619 ) tracked collectively as PHP2Shell.”
SupportedResearchers from Calif, Wiz and OpenAI discovered the flaws.BleepingComputer: “The two unauthenticated RCE flaws were discovered by Calif , Wiz , and OpenAI security researchers”
SupportedThe flaws allow unauthenticated attackers to execute code with web-worker privileges.BleepingComputer: “CVE-2026-109618 can be used to gain remote code execution as the web worker account by exploiting a chain of weaknesses that trigger out-of-memory corruption, while the CVE-2026-109619 stale global state vulnerability enables unauthenticated heap use-after-free, memory disclosure, and remote code execution with the web worker's privileges.”
SupportedThe PHP team considers mod_php the highest-risk setup, with an exploit that can run before application code.BleepingComputer: “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs,”
SupportedBoth vulnerabilities stem from PHP memory being left corrupted when a request ends abnormally.BleepingComputer: “Both flaws stem from the same underlying problem: PHP can leave its memory in a corrupted state when a request ends abnormally, and both can be exploited to achieve remote code execution.”
SupportedThe fixes for PHP 8.x are versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.BleepingComputer: “Admins should install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible on servers running PHP 8.x”
SupportedThe PHP team provided minimal source backports for PHP 7.4, 8.0 and 8.1 for people building from source or without access to an LTS vendor.BleepingComputer: “Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4 , PHP 8.0 , and PHP 8.1 to help people building from source or without access to an LTS vendor.”
SupportedBefore the patches were released, Cloudflare CTO Dane Knecht confirmed early attacks targeting the vulnerabilities.BleepingComputer: “Before the patches were released, Cloudflare CTO Dane Knecht confirmed that the company (which had already deployed a set of WAF rules designed to block known PHP2Shell exploitation methods) was already observing early attacks targeting the two vulnerabilities.”
SupportedThe UK NCSC warned organisations to update PHP systems immediately or take them offline until patched.BleepingComputer: “The UK National Cyber Security Centre (NCSC) has also warned UK organizations to immediately update systems using PHP or take them offline until they can be patched.”