# PHP Patches Two Critical RCE Flaws Nicknamed "php2shell," Rated CVSS 9.2 URL: https://edufabtech.com/news/php-core-rce-flaws-php2shell-october-2026 Section: News · Technology Published: 2026-10-22 Publisher: EduFabTech (https://edufabtech.com) > PHP shipped emergency patches on 21 October 2026 for two critical, unauthenticated RCE flaws nicknamed php2shell. PHP runs 69.3% of websites with known server-side language, per W3Techs (2026). The PHP development team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 as an out-of-cycle security release, according to the project's security advisory on php.net, headlined "Security advisory: Critical remote code execution vulnerabilities, update now." The advisory says the two flaws fixed "can allow unauthenticated remote code execution" and urges all PHP users to update immediately. The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, have been nicknamed "php2shell" in vendor write-ups, including Tenable's FAQ on the two CVEs. The PHP security team rates both at CVSS v4.0 9.2 out of 10, the score Tenable's FAQ also reports. ![A four-step CVSS severity ladder from Low to Critical, with the Critical tier lit up and a side panel noting mod_php as the highest-risk configuration.](https://edufabtech.com/uploads/2026/10/php-core-rce-flaws-php2shell-october-2026-2.png) *A four-step CVSS severity ladder from Low to Critical, with the Critical tier lit up and a side panel noting mod\_php as the highest-risk configuration. — EduFabTech · Own work* ## What the two bugs actually do CVE-2026-109618 is a memory-corruption bug tied to how PHP handles out-of-memory conditions: when PHP runs out of memory while initializing request data, that data is left only partially set up, and PHP's cleanup routine then treats it as valid, opening a path to code execution, as described by Tenable's analysis of the advisory. CVE-2026-109619 is a use-after-free: internal state tied to one request can outlive the memory that backs it, and a later request handled by the same worker process can reuse that stale state before it is properly reinitialized. PHP's own advisory states that "all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod\_php, php-cgi, FrankenPHP and LiteSpeed," and names mod\_php as the highest-risk configuration, citing "a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs." ## Scale of exposure PHP is the server-side language behind 69.3% of websites whose server-side language is known, according to W3Techs' usage statistics as of 22 October 2026. That includes content-management systems such as WordPress and Joomla, which run on PHP and inherit the exposure of the underlying runtime unless their hosting stack has been updated. ## Who is affected, and what is not fixed The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; everything before those four releases, across the 8.2–8.5 branches, is vulnerable, per the php.net advisory. PHP 7.4, 8.0 and 8.1, already outside the PHP project's normal support window, did not get a packaged release: the PHP security team instead issued minimal source-only backports for those who build PHP from source, according to the advisory and Tenable's FAQ. PHP 5.4 through 7.3 remain, in Tenable's wording, "end-of-life, no fix from the PHP project" at all. ![A three-stage timeline from the 17 October honeypot exploitation attempt to the 21 October emergency patch to the PHP branches that remain unfixed.](https://edufabtech.com/uploads/2026/10/php-core-rce-flaws-php2shell-october-2026-3.png) *A three-stage timeline from the 17 October honeypot exploitation attempt to the 21 October emergency patch to the PHP branches that remain unfixed. — EduFabTech · Own work* ## Exploitation status PHP's advisory lists mitigations for anyone who cannot update immediately, mapped to each flaw: for CVE-2026-109618, setting `memory_limit=-1` so applications cannot override it; for CVE-2026-109619, disabling `session.upload_progress` and, on PHP 8.5, `fatal_error_backtraces`. The advisory describes these as partial blocks on specific attack paths, not complete fixes for either bug — updating the PHP runtime is the only complete fix. Tenable's FAQ states that the PHP Foundation "did not identify any functional exploits at the time of release," but exploitation attempts were already under way before the patches shipped: Amazon Threat Intelligence said it observed a php2shell exploitation attempt against its MadPot honeypot network on 17 October 2026, four days before the 21 October release. ## Why it matters for developers and researchers For anyone running a PHP-based research tool, course-management plugin, lab website or personal project, the practical task is the same regardless of application code: update the PHP runtime itself, since no amount of application-level input validation closes either bug. Students and engineers maintaining departmental WordPress sites, Moodle instances, or custom PHP services built for coursework should treat this the same way as any other unauthenticated, pre-authentication RCE — assume internet-facing and prioritize the runtime update over waiting for a framework-level patch, since the vulnerability sits below the application layer, in PHP's own request-handling internals. The incident is also a reminder of how concentrated risk is in widely shared runtimes: a single pair of bugs in PHP's core memory handling reaches a majority of the publicly indexed web in one release cycle, a scale that smaller, less-used languages and frameworks rarely produce from one disclosure. ## Sources 1. The PHP Group. (2026). Security advisory: critical remote code execution vulnerabilities (PHP 8.2–8.5). php.net https://www.php.net/archive/2026.php#2026-10-21-5 2. Tenable. (2026). php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ. Tenable https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote 3. W3Techs. (2026). Usage statistics of PHP for websites. W3Techs https://w3techs.com/technologies/details/pl-php --- Source page: https://edufabtech.com/news/php-core-rce-flaws-php2shell-october-2026 Quote with a link to the source page. © EduFabTech.