- PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, two critical remote-code-execution flaws.
- PHP rated both vulnerabilities 9.2 under CVSS v4.0, while an online leak claimed a CVSS 10.0 score that PHP did not assign.
- The affected PHP releases serve web requests, including through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP released emergency updates on Oct 21, 2026, for two critical remote-code-execution flaws tracked as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. PHP rated each vulnerability 9.2 under CVSS v4.0.
The affected systems include PHP installations that serve web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP said an attacker without an account could run code on a web server, while SecurityWeek said the flaws could also expose process memory containing credentials, API keys and other secrets.
PHP is a general-purpose scripting language geared toward web development. SecurityWeek said remote code execution was confirmed for both vulnerabilities on Apache with mod_php, and that the flaws affect nearly all PHP releases back to PHP 5.4.
On this page
PHP2Shell includes OOM corruption and stale global state
SecurityWeek identified CVE-2026-109618 as out-of-memory corruption and CVE-2026-109619 as stale global state. PHP described the pair as memory-safety bugs.
watchTowr said successful exploitation requires no account or prior access because “Reaching the server over the network is enough; no account or prior access is needed.”
PHP workers must restart after the update
PHP’s advisory said updating to a release containing the patch is the only complete mitigation for the out-of-memory flaw. For the stale-global-state flaw, PHP said updating is the only reliable mitigation.
watchTowr said administrators should restart every PHP worker after installing the update so the fix takes effect across the environment.
The Hacker News said the flaws were found by Wiz Research, Calif and OpenAI’s Codex Security team.
PHP said the fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its security team had announced the planned release on Oct 20, 2026, without naming the CVE identifiers.
What to do now
- Do not use RLIMIT_AS or RLIMIT_DATA, as these will cause mmap() to fail once the memory limit is reached, triggering the vulnerable longjmp() path.
FAQ
What are the PHP2Shell vulnerabilities?
PHP said PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, two critical remote-code-execution flaws in PHP.
Which PHP versions are affected by PHP2Shell?
SecurityWeek said the flaws affect nearly all PHP releases back to PHP 5.4, and PHP said installations that serve web requests are at risk.
Can PHP2Shell attackers run code without an account?
PHP said the flaws let an attacker without an account run code on a web server. watchTowr said reaching the server over the network is enough and no prior access is needed.
Why is PHP2Shell risk highest on Apache mod_php?
PHP said the risk is highest for sites running Apache with mod_php. SecurityWeek said remote code execution was confirmed for both vulnerabilities on Apache with mod_php.
What is CVE-2026-109618?
SecurityWeek identified CVE-2026-109618 as an out-of-memory corruption flaw.
Sources
- RCE via OOM corruption, GitHubPrimary
- RCE via stale global state, GitHubPrimary
- CVE-2026-109619: PHP Remote Code Execution Exploited, watchTowrPrimary
- PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge, The Hacker News
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors, SecurityWeek
- PHP ships emergency patches for critical PHP2Shell flaws, BleepingComputer
- PHP2Shell: The Emergency PHP Patch Is Out, and the Real Race Starts Now, Techaeris
- PHP rushes out emergency patches for two critical bugs AI found first, The Next Web
- Critical security flaw puts most websites at risk as NSA issues warning, Milwaukee Journal Sentinel
- PHP, Wikipedia
How we checked this story
| Claim | Source | Status |
|---|---|---|
| PHP released emergency updates fixing two critical flaws that allow unauthenticated attackers to run code on web servers. | PHP, via The Hacker News | Attributed |
| The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. | PHP, via The Hacker News | Attributed |
| The vulnerabilities affect PHP installations that serve web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. | PHP, via The Hacker News | Attributed |
| SecurityWeek reported that both vulnerabilities have confirmed remote code execution on Apache with mod_php. | SecurityWeek | Attributed |
| SecurityWeek said the PHP2Shell flaws affect nearly all PHP releases back to PHP 5.4. | SecurityWeek | Attributed |
| SecurityWeek said the vulnerabilities can also read sensitive process memory containing credentials, API keys and other secrets. | SecurityWeek | Attributed |
| PHP released emergency patches for two critical remote-code-execution vulnerabilities collectively tracked as PHP2Shell. | PHP, via BleepingComputer | Attributed |
| PHP said updating was the only safe choice and that the risk was highest for Apache mod_php. | PHP, via The Next Web | Attributed |
| watchTowr said successful exploitation requires no account or prior access because reaching the server over the network is enough. | watchTowr | Attributed |
| PHP’s OOM advisory says updating to a release containing the patch is the only complete mitigation. | PHP, via GitHub | Confirmed |
| PHP’s stale-global-state advisory says updating is the only reliable mitigation. | PHP, via GitHub | Confirmed |
| watchTowr said administrators should restart every PHP worker after installing the update. | watchTowr | Attributed |
| PHP is a general-purpose scripting language geared toward web development. | Wikipedia | Confirmed |
| Milwaukee Journal Sentinel said the vulnerability could let attackers take control of or disrupt websites and access sensitive user information. | Milwaukee Journal Sentinel | Attributed |
| The leak’s claim that the flaws had a CVSS 10.0 score was not PHP’s; PHP rates both flaws 9.2. | PHP, via The Hacker News | Attributed |
| SecurityWeek identified CVE-2026-109618 as OOM corruption and CVE-2026-109619 as stale global state; both have a CVSS score of 9.2. | SecurityWeek | Attributed |
| PHP’s advisory rates each flaw 9.2 under CVSS v4.0, while watchTowr’s chief executive and some early reports called them CVSS 10.0. | PHP, via Techaeris | Attributed |
| Techaeris said pHP2Shell covers CVE-2026-109618 and CVE-2026-109619, both remote code execution flaws rated CVSS v4.0 9.2. | Techaeris | Attributed |
| The patched PHP releases fix two memory-safety bugs tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS v4 scale. | PHP, via The Next Web | Attributed |
| PHP announced a security release for 21 October 2026 at 14:00 UTC covering two critical vulnerabilities, each rated CVSS v4.0 9.2. | PHP | Attributed |
| watchtowr.com published its report on Oct 21, 2026. | watchtowr.com | Confirmed |
Could not verify
- Whether a specific server was successfully compromised is not established.
- How many installations were affected is not established.
- Whether the reported exploitation attempts resulted in code execution is not established.
- Whether the two vulnerabilities were exploited by the same actors is not established.
Related stories
Vulns & PatchesPHP php2shell flaws could enable unauthenticated remote code execution
Vulns & PatchesOpenAI launches Patch the Planet to address critical open-source flaws
Vulns & PatchesPHP 8.x updates fix two critical RCE flaws after disclosure leak