PHP Patches Two Critical RCE Flaws Nicknamed "php2shell," Rated CVSS 9.2

The PHP development team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 as an out-of-cycle security release, according to the project's security advisory on php.net, headlined "Security advisory: Critical remote code execution vulnerabilities, update now." The advisory says the two flaws fixed "can allow unauthenticated remote code execution" and urges all PHP users to update immediately.

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, have been nicknamed "php2shell" in vendor write-ups, including Tenable's FAQ on the two CVEs. The PHP security team rates both at CVSS v4.0 9.2 out of 10, the score Tenable's FAQ also reports.

What the two bugs actually do

CVE-2026-109618 is a memory-corruption bug tied to how PHP handles out-of-memory conditions: when PHP runs out of memory while initializing request data, that data is left only partially set up, and PHP's cleanup routine then treats it as valid, opening a path to code execution, as described by Tenable's analysis of the advisory. CVE-2026-109619 is a use-after-free: internal state tied to one request can outlive the memory that backs it, and a later request handled by the same worker process can reuse that stale state before it is properly reinitialized.

PHP's own advisory states that "all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed," and names mod_php as the highest-risk configuration, citing "a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."

Scale of exposure

PHP is the server-side language behind 69.3% of websites whose server-side language is known, according to W3Techs' usage statistics as of 22 October 2026. That includes content-management systems such as WordPress and Joomla, which run on PHP and inherit the exposure of the underlying runtime unless their hosting stack has been updated.

Who is affected, and what is not fixed

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; everything before those four releases, across the 8.2–8.5 branches, is vulnerable, per the php.net advisory. PHP 7.4, 8.0 and 8.1, already outside the PHP project's normal support window, did not get a packaged release: the PHP security team instead issued minimal source-only backports for those who build PHP from source, according to the advisory and Tenable's FAQ. PHP 5.4 through 7.3 remain, in Tenable's wording, "end-of-life, no fix from the PHP project" at all.

Exploitation status

PHP's advisory lists mitigations for anyone who cannot update immediately, mapped to each flaw: for CVE-2026-109618, setting memory_limit=-1 so applications cannot override it; for CVE-2026-109619, disabling session.upload_progress and, on PHP 8.5, fatal_error_backtraces. The advisory describes these as partial blocks on specific attack paths, not complete fixes for either bug — updating the PHP runtime is the only complete fix.

Tenable's FAQ states that the PHP Foundation "did not identify any functional exploits at the time of release," but exploitation attempts were already under way before the patches shipped: Amazon Threat Intelligence said it observed a php2shell exploitation attempt against its MadPot honeypot network on 17 October 2026, four days before the 21 October release.

Why it matters for developers and researchers

For anyone running a PHP-based research tool, course-management plugin, lab website or personal project, the practical task is the same regardless of application code: update the PHP runtime itself, since no amount of application-level input validation closes either bug. Students and engineers maintaining departmental WordPress sites, Moodle instances, or custom PHP services built for coursework should treat this the same way as any other unauthenticated, pre-authentication RCE — assume internet-facing and prioritize the runtime update over waiting for a framework-level patch, since the vulnerability sits below the application layer, in PHP's own request-handling internals.

The incident is also a reminder of how concentrated risk is in widely shared runtimes: a single pair of bugs in PHP's core memory handling reaches a majority of the publicly indexed web in one release cycle, a scale that smaller, less-used languages and frameworks rarely produce from one disclosure.