PHP releases emergency fixes for critical PHP2Shell vulnerabilities

PHP has released emergency security updates that address two critical vulnerabilities, collectively known as PHP2Shell.

The flaws could allow unauthenticated attackers to execute code on vulnerable web servers. Administrators should update immediately, as configuration changes cannot fully mitigate the flaws.

The security announcement confirms that PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the fixes. Tracked as CVE-2026-109618 and CVE-2026-109619, both vulnerabilities carry a critical CVSS v4.0 score of 9.2.

The release follows information leaking online on October 20, ahead of coordinated disclosure. Huntress documented the premature disclosure, while PHP’s maintainers issued an advance warning urging users to prepare for emergency patching.

Massive impact

PHP underpins WordPress, Drupal, Joomla, Magento, and many custom web applications, making the vulnerabilities relevant to website owners, hosting providers, and enterprise administrators. The affected software also appears in control panels and shared hosting infrastructure.Wiz reports PHP2Shell roughly impacts 70% of the internet.

PHP’s maintainers identify all installations serving web requests as potentially at risk, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP, and LiteSpeed. They consider mod_php the highest-risk deployment, with a demonstrated attack that executes before application code begins running.

The first vulnerability, CVE-2026-109618, concerns PHP’s handling of out-of-memory errors. Memory exhaustion can interrupt processing while internal request data is only partially initialized. During cleanup, PHP may then use this invalid data, creating an opportunity for code execution.

Researchers validated unauthenticated exploitation over HTTP against mod_php using default PHP input and memory limits. Successful exploitation runs code with the web worker account’s privileges. The advisory also identifies PHP-FPM as susceptible based on source analysis, although it reports no complete FPM exploit for this particular flaw.

The second vulnerability, CVE-2026-109619, involves internal state surviving after the memory it references has been freed. A subsequent request handled by the same worker can access those stale references before normal initialization resets them, causing a use-after-free condition.

Confirmed paths involve fatal-error backtraces and session upload-progress handling. Unlike the first vulnerability’s FPM assessment, this advisory describes a validated FPM path, although exploitation requires a suitable application operation.

Exploitation attempts underway

Meanwhile, Cloudflare CTO Dane Knecht reported early attacks and said the company was updating mitigations as new vectors emerged. He stressed that these defenses were temporary and that administrators still needed to patch.

PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.

We are seeing early attacks emerging and are updating mitigations as new vectors show… https://t.co/wMz9tDTWwH

— Dane Knecht 🦭 (@dok2001) October 21, 2026

Administrators should install the fixed release for their PHP branch or obtain patched packages from their distribution vendor. PHP also provided minimal source backports for unsupported versions 7.4, 8.0, and 8.1.

Disabling session upload progress blocks specific confirmed paths but leaves other variants exposed. Website owners should confirm with their hosting provider that the underlying PHP runtime has been patched. Updating WordPress or its plugins alone does not replace that server-side update.