PHP2Shell: critical PHP remote code execution – patch now

PHP2Shell: Critical Remote Code Execution Vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619)

On 20 October 2026, the PHP security community publicly disclosed PHP2Shell, a pair of high-impact vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both affect PHP versions from 5.4 through 8.5.11 and allow unauthenticated remote code execution. The PHP maintainers rated the issue 9.2 out of 10 under CVSS v4.0, placing it in the critical band. Because PHP underpins roughly 70-80% of websites worldwide, the disclosure has immediate consequences for hosting providers, agencies, e-commerce operators, and anyone running a PHP-based site.

What the two CVEs actually do

CVE-2026-109618 is an out-of-memory handling flaw. When PHP hits an out-of-memory condition, it uses longjmp to abort the current request. Some execution paths do not account for that abrupt exit, so request memory remains partially initialized. During cleanup, the engine treats that invalid memory as valid data. An attacker can then influence execution flow and run arbitrary code on the server.

CVE-2026-109619 is a stale global state flaw. PHP keeps global variables that temporarily point to request memory. In certain situations, that global state is not reset correctly or is repopulated after being freed. It then references memory blocks that no longer belong to active requests. Later operations read or branch on this stale state before it is properly initialized, which again opens the door to remote code execution.

In plain terms, PHP is the engine that builds and runs most dynamic websites. These bugs are like a defect in how the engine manages its workspace and disposes of temporary data. An outsider can send a crafted request that overwhelms or confuses the engine's memory handling. When the engine stumbles, the attacker can turn that confusion into commands executed on the web server, without any login or password.

Why the risk is urgent

A successful attacker gains code execution with the privileges of the web server worker account. That access can be used to install a payload, disguise malicious scripts as ordinary website files, reduce web activity, show different traffic to different users, spy on card data entered at checkout, or ask visitors to verify a command in order to install malware. Many of these actions are invisible to normal users and even to site administrators. The site may look healthy while it is quietly serving malicious content or leaking data.

Exploitation attempts were detected in the wild before patches were fully available. That makes PHP2Shell a patch-now incident, not a routine maintenance task. Every hour of delay increases the chance that an automated scanner finds an exposed installation.

Patched versions and what to do

The PHP maintainers released emergency updates on 21 October 2026 for supported branches. The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Source code patches were also published for PHP 7.4, 8.0, and 8.1, but those branches are end of life and no official updated binaries were provided. Sites still running them should move to a supported version immediately or use a reputable long-term support provider.

PHP2Shell patched releases

Administrators should update PHP, restart PHP-FPM or the relevant worker processes, and confirm that the running version matches the patched release. If you manage a site but are not the server administrator, contact your hosting provider or administrator now and ask for a PHP2Shell check. A quick check should cover the PHP version, the web server configuration, recent file changes, unexpected scheduled tasks, and outbound connections. Do not wait for visible symptoms: an infected PHP site can remain fully functional while an attacker operates inside it.

For technical teams, the priority is to patch all PHP runtimes, including containers, staging environments, and forgotten subdomains. Review logs for unusual POST requests, memory-related errors, and unexpected child processes. Rotate secrets if compromise is suspected. For non-technical readers, the message is simple: ask your administrator to verify the PHP version and apply the emergency update. PHP2Shell is critical, public, and actively dangerous.

If you run an online store, a blog, or a customer portal, treat this as a security incident until your PHP version is confirmed patched. Ask for written confirmation of the version and the restart time. Keep backups offline, monitor for unexpected admin accounts, and review checkout pages for changes. The cost of a quick update is small compared with the cost of card data theft, defacement, or a malware distribution campaign.