On 21 October 2026 at 14:00 UTC, PHP released emergency patches for two critical bugs now being called PHP2Shell. The fix is in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team is strongly urging all users to update immediately. The bug sits inside the PHP engine itself, so a clean WordPress, WooCommerce or Magento codebase does not protect you. helpnetsecurity
What PHP2Shell is and when it came out
PHP2Shell is the combined name for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both allow remote code execution. Remote code execution means someone sitting far away can run commands of their choice on your server. Wikipedia
The existence of the bugs became public on 20 October, and an emergency patch followed the next day. The details leaked before the coordinated disclosure was complete. Wikimedia’s Phabricator was taken offline as a precaution a few hours before the patch. PHP2Shell +2
On severity, the PHP security team rated both bugs 9.2 on CVSS v4.0, and both can be exploited without authentication. watchTowr gave it a full 10.0. CERT-EU listed both CVE ids with a 9.2 score in advisory 2026-018 on 20 October. PHP2Shell: CVE-2026-109618 & CVE-2026-109619 +2
Which PHP versions and setups are at risk
According to Wiz, versions from PHP 5.4 all the way through PHP 8 are affected. Old, supported and new branches are all covered. Wikipedia
JFrog describes the affected configuration as session.upload_progress.enabled=On, which is the factory default, together with multipart uploads being accepted. So most servers running default settings fall inside the risk zone. jfrog
The key point is that putting a login on your site does not stop this attack. Datadog reproduced it with an unauthenticated HTTP POST on PHP 8.5.11 and confirmed that application-level authentication cannot block it, because PHP processes the malicious request before any application code runs. CrowdStrike verified end to end that a single anonymous POST can make an Apache mod_php worker launch a shell process and run the attacker’s command, with no session and no vulnerable application code involved. datadoghqcrowdstrike
The web server type matters a little too. PHP’s own advisory describes a demonstrated exploit against Apache with mod_php. Source analysis suggests PHP-FPM is also susceptible, but a complete FPM exploit for CVE-2026-109618 has not been demonstrated yet. In my view, FPM users should not treat that as “probably safe”, since an exploit not being shown is not the same as the bug not existing. socradarbrandefense
E-commerce stores are hit most directly. Sansec researchers confirmed unauthenticated RCE against Magento 2.4.9 and ten other PHP applications. Magento, Shopware and WooCommerce stores are exposed even when their own code is clean, and the fix comes only from updating PHP on the server, not from store code. sansecsansec
Both bugs in plain language
Both bugs share the same root: PHP gets interrupted in the middle of a request, and some internal data is left half-finished or stale.
PHP titles CVE-2026-109618 “RCE via OOM corruption”. When memory runs out, PHP can leave a request’s internal data only partly initialized, and the cleanup step then treats that invalid data as valid. This bug also leaks memory on its own, and Sansec compares it to Heartbleed. brandefensesansec
CVE-2026-109619 is the “RCE via stale global state” bug. When a fatal error hits during a request, usually when memory_limit is crossed, native code is interrupted before it cleans up. A later request, or a reused worker, then treats the freed memory as live data. brandefensesansec
At the code level, Upwind says the problem is in the php_session_rfc1867_callback function in ext/session/session.c, which caches two pointers inside HashTables while tracking multipart upload progress. A second request re-reads the session, that HashTable gets destroyed, and the pointers keep looking at old memory. The advisory ids are GHSA-w8hw-w9fx-j79w for CVE-2026-109618 and GHSA-6wmf-4rv5-p3rp for CVE-2026-109619. upwindupwind
CrowdStrike classifies both under CWE-824, access of an uninitialized pointer. Different security firms describe the bug in slightly different words, so for the exact root cause the GHSA advisories above are the safer reference. crowdstrike
From research to leak to patch
The story did not arrive out of nowhere. It ran in three phases.
The research phase came first. Calif found multiple RCE paths on 1 August, and on 11 August Calif reported the first bug to PHP and coordinated disclosure began. On 24 August, Wiz Research reported the vulnerabilities to PHP as well. sansecsansec
Then came the leak, on 20 October. The details leaked that day and watchTowr confirmed remote code execution. The same day, the PHP security team announced a security release for 21 October at 14:00 UTC. sansecjfrog
The final phase was 21 October itself. Cloudflare reported early attacks at 07:43, and PHP released the fixed versions at 14:00. PHP had already warned that fixes could come earlier if technical details were published or in-the-wild exploitation appeared. The leak cut the time available for patching short. sansecsecurityweek
How to apply the patch
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Brandefense lists the same versions and shows 8.4.27 as the 21 October 2026 release that follows 8.4.26. These are the same 8.5.12 and 8.4.27 that were being tested as release candidates earlier, and the final versions are now out. brandefense
First, check your version:
php -v
This shows the command-line PHP version. The web server can use a different one, so cross-check with your hosting panel or a phpinfo page. Whether you must restart PHP-FPM or Apache after updating depends on your Linux distro, so follow its guide.
If you are on managed or shared hosting, the PHP version is usually changed from the hosting panel, or the provider updates it for you. Ask your provider to confirm that the patched build is installed.
If you cannot update right now
In my view the patch should always come first, and any workaround is only a temporary barrier. Still, if updating immediately is not possible:
Brandefense suggests setting memory_limit=-1 for CVE-2026-109618, ideally at server level (php_admin_value in the FPM pool or in the Apache config) so the application cannot override it. Datadog also advises enforcing memory_limit=-1 at administrator level, together with request limits at the frontend and memory limits on the container. memory_limit=-1 means PHP stops capping itself, which is why a container or OS-level limit alongside it looks necessary. brandefensedatadoghq
Turning off the upload progress feature is another idea. JFrog named it as the vulnerable configuration, so disabling it may close that path. I could not confirm it as an official workaround, though, so check PHP’s official advisory. It is not a substitute for the patch.
What to do on older PHP versions
The PHP project no longer supports PHP 8.1 and earlier. Some distributions and LTS vendors offer backported fixes, so contact them or upgrade to a supported release. helpnetsecurity
People on 8.2 should pay attention too. PHP 8.2 reaches end of life on 31 December 2026 and stops receiving security fixes after that. From the same source, PHP 8.4 has active support until 31 December 2026 and security fixes until 31 December 2028, while PHP 8.5 gets active support until the end of 2027 and security fixes until 2029. If you ask me, 8.5 buys the most time for a new setup or an upgrade. cleverclever
Exploitation status and fake PoCs
The exploitation picture is not clear yet, and the sources say slightly different things. As of 21 October, PHP had not reported in-the-wild exploitation and CISA had not added either CVE to its catalog. But Sansec’s timeline mentions Cloudflare reporting early attacks at 07:43 on 21 October. SecurityWeek warned of mass exploitation after the leak, and watchTowr had already reproduced CVE-2026-109618. So do not put this patch on a “later” list. PHP2Shell: CVE-2026-109618 & CVE-2026-109619 +2
There is another risk. JFrog reports fake PoCs circulating around the disclosure. Downloading random exploit code from GitHub or Telegram and running it on your own server can hurt you more than the bug itself. jfrog
Who this is for and who it is not for
This post is for people who run a VPS or dedicated server, because they control the PHP version and have to apply the patch themselves. It is also for WordPress, WooCommerce and Magento store owners, because the fix will not come from a plugin or theme update and they will have to talk to their hosting provider. Developers who pin PHP versions in Docker or CI should read it too, since they need to move their base image to a patched version.
People whose sites do not run on PHP at all (Node, Python or a static stack) are not directly affected. Users of hosted website builders can treat this as background information, since they do not control the server. They can confirm with their provider.
Next practical step
Check your PHP version today with both php -v and your hosting panel. If it is below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (whichever branch you are on), update it or ask your provider for an update date.
Sources
- https://en.wikipedia.org/wiki/PHP2Shell
- https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/
- https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/
- https://sansec.io/research/php2shell
- https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/
- https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/
- https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
- https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/
- https://www.upwind.io/feed/initial-assessment-php2shell-two-critical-unpatched-php-rces-cve-2026-109618-cve-2026-109619
- https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/
- https://www.clever.cloud/developers/changelog/2026/09-01-php-8.5-default/
Disclaimer
This post is based on public security reports and is not professional security advice. Before changing a production server, take a backup and confirm with PHP’s official advisory or your hosting provider.
Gemini 4 Argon: What You Need to Know Before 30 Nov
ChatGPT Dots: What Is It? My Real 2-Day Experience
MiniMax H3 Explained: The Open-Source AI Video Generator Everyone's Talking About
