home / blog
2026-10-21 · critical
PHP2Shell: two critical CVEs in the PHP runtime (CVE-2026-109618 and CVE-2026-109619)
Two critical vulnerabilities in the PHP runtime, CVSS 9.2. Fixed versions for each branch: update exposed systems now.
On 21 October 2026 PHP published fixes for two critical vulnerabilities in its runtime, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. The CVSS v4.0 score is 9.2. Disclosure took place on 20 October, with details already circulating before the embargo lifted.
The first concerns memory handling under out-of-memory conditions. The second concerns stale internal state that still refers to memory already freed. Together they can allow, under certain conditions, unauthenticated remote code execution with the privileges of the PHP process.
The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The 8.1 and earlier branches no longer receive upstream fixes: they need a supported branch or a verified vendor patch. Affected versions should be checked on the installed package, not on the version reported by the CLI alone.
The Canadian Centre for Cyber Security reports a public proof of concept and exploitation attempts in several countries, without confirmed active exploitation at the time of its advisory, and flags mod_php setups as the highest risk.
Prioritise patching PHP systems exposed to the internet. After updating, restart PHP-FPM, Apache and containers, and check logs for anomalous multipart requests and recurring worker crashes. Disabling session.upload_progress reduces exposure but does not by itself close the two vulnerabilities.
At a glance
- What
- Two vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. They can allow unauthenticated remote code execution under certain conditions.
- Severity
- CVSS v4.0 9.2 (critical).
- Causes
- CVE-2026-109618: unsafe memory handling under out-of-memory conditions. CVE-2026-109619: stale internal state referring to memory already freed.
- Affected versions
- PHP 8.5.0–8.5.11, fixed in 8.5.12. PHP 8.4.0–8.4.26, fixed in 8.4.27. PHP 8.3.0–8.3.35, fixed in 8.3.36. PHP 8.2.0–8.2.34, fixed in 8.2.35. PHP 8.1 and earlier: depends on the branch and on vendor patches.
- Exposed components
- PHP-FPM with Nginx, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP, Docker containers with PHP. Applications running on PHP (CMS, admin panels, APIs) inherit the runtime risk.
- Status
- A public proof of concept has been reported and exploitation attempts in several countries. At the time of the Canadian advisory, active exploitation was not yet confirmed.
- Action
- Prioritise patching. Check the real version of the CLI, PHP-FPM, Apache modules and containers: php -v may not match the web server runtime. Restart services and confirm the workers use the fixed version.
Sources: Canadian Centre for Cyber Security, AL26-026 · Palo Alto Networks Unit 42