PHP2Shell: Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) — Urgently Update to 8.5.12, 8.4.27, 8.3.36, 8.2.35

On October 21, 2026, the PHP team released emergency security updates PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. They close two critical vulnerabilities that allow remote code execution without authentication: CVE-2026-109618 and CVE-2026-109619. Both have a CVSS v4.0 score of 9.2. The media collectively call them PHP2Shell.

What happened

Both flaws stem from PHP potentially leaving memory in a corrupted state if a request terminates abnormally:

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): RCE via memory corruption on out-of-memory (OOM). If a request hits memory_limit at an unfortunate moment, the request's internal data remains only partially initialized. During request cleanup, PHP may treat it as valid. On Apache with mod_php, the attack can be triggered by an unauthenticated request before application code even executes. According to the PHP Foundation, full remote code execution has been demonstrated with default settings. On PHP-FPM, RCE has been confirmed through code paths in the application.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): RCE via "stale" global state. A fatal error at an unfortunate moment can leave internal state pointing to already freed memory from a previous request. The next request in the same worker can exploit this memory (use-after-free). Consequences: memory data leakage, worker crash, and code execution.

Who is affected

According to the PHP team, all PHP installations serving web requests are at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The highest risk is for mod_php.

Vulnerable versions (per the AWS bulletin):

• PHP 8.5.0–8.5.11: fixed in 8.5.12
• PHP 8.4.0–8.4.26: fixed in 8.4.27
• PHP 8.3.0–8.3.35: fixed in 8.3.36
• PHP 8.2.0–8.2.34: fixed in 8.2.35
• PHP 8.1 and older are no longer supported by the PHP project. The PHP security team has published minimal source-code backports for 7.4, 8.0, and 8.1. Also check for updates from your distribution or LTS vendor.

The fixes are also included in the PHP 8.6.0 RC4 test build.

How serious is it

PHP runs on most websites worldwide, including WordPress, Joomla, Drupal, Laravel, and Symfony. According to BleepingComputer, Cloudflare recorded the first attack attempts before the patches were even released and deployed temporary WAF rules. The UK's NCSC urged immediate updates or temporarily disabling vulnerable systems. PHP developers emphasize that there are no full workarounds: only updating provides reliable protection.

What to do now

1. Check your PHP version. In the console, run php -v. For a web server, the version may differ, so check it via phpinfo() or in your hosting panel. For FPM, run php-fpm -v (or, for example, php-fpm8.3 -v).
2. Update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. On Linux, install the updated packages from your distribution (distributions received patches in advance), for example apt update && apt upgrade or dnf upgrade php*.
3. Restart all workers for PHP-FPM, Apache, and other SAPIs. Rebuild and redeploy Docker images.
4. If you are on PHP 8.1 or older, plan a migration to a supported branch. Also note that PHP 8.2 support ends on December 31, 2026.

Temporary measures if you cannot update immediately (they only reduce risk but do not eliminate it):

• For CVE-2026-109618: set memory_limit=-1 via php_admin_value so the application cannot change this value. Reduce post_max_size to 8M (or to 32M if file uploads are required). Limit request size and complexity at the web server or proxy level.
• For CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini or in the FPM pool configuration and restart the workers. On PHP 8.5, also set fatal_error_backtraces=0.

Sources

• php.net: Security advisory: Critical remote code execution vulnerabilities
• The PHP Foundation: Today's PHP Security Release
• AWS Security Bulletin 2026-143-AWS
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
• Canadian Centre for Cyber Security: AL26-026

Let's upgrade your project to a new PHP version

The CRM Go team upgrades client projects to current, secure PHP versions. We check code compatibility, update dependencies and frameworks, test the project, and deploy updates with no website downtime. If you are not sure whether your server is already protected from PHP2Shell, contact us and we will help.