On 21 October 2026, the PHP development team released emergency security updates to address two critical vulnerabilities that could allow attackers to execute malicious code on vulnerable web servers without authentication.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have each received a CVSS 4.0 severity score of 9.2 out of 10. Collectively known as PHP2Shell, they affect the PHP runtime itself rather than individual applications.
These vulnerabilities are particularly dangerous because PHP is used by many content management systems, including WordPress, Joomla and Drupal, as well as countless other websites and web applications.
What Makes the Vulnerabilities Dangerous?
Both security flaws are related to errors in the way that PHP manages memory. Under certain conditions, attackers can exploit these weaknesses to run arbitrary code with the same privileges as the affected web server process.
The two vulnerabilities work differently:
- CVE-2026-109618: Improper handling of out-of-memory conditions can leave internal request data partially initialized. Subsequent cleanup operations may process invalid memory, potentially allowing remote code execution.
- CVE-2026-109619: Internal request data can remain accessible after its allocated memory has been freed. This use-after-free vulnerability can lead to memory disclosure and remote code execution.
If successful, attackers could exploit the vulnerability to access sensitive files, steal database credentials, manipulate website content, or install malware.
Of particular concern is the fact that the vulnerabilities can be exploited without authentication or user interaction. According to the PHP security team, installations using Apache with mod_php are especially at risk, as an attack can be triggered before the application processes the request itself.
Other affected environments include PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
Which PHP Versions Are Affected?
These vulnerabilities affect all versions of PHP dating back to PHP 5.4. Security updates are available for all four of the officially supported PHP branches.
The following versions were released on October 21, 2026:
| PHP branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1 and older versions no longer receive official security releases from the PHP project. Administrators who are still using these versions should either upgrade to a supported release or check whether their Linux distribution or extended-support provider offers backported security fixes.
PHP 8.2 will also reach its end of life on December 31, 2026.
Security Researchers Warn of Exploitation
The fact that information about the vulnerabilities had circulated online before the planned disclosure increased concerns that attackers could develop exploits before administrators had installed the patches.
Security researchers have already demonstrated successful exploitation of the vulnerability, and proof-of-concept code is now available. Consequently, security agencies have urged organisations to update their PHP installations immediately.
The discovery has also prompted the implementation of precautionary measures across Europe. Several government websites and other online services were temporarily taken offline while administrators assessed the risks and implemented security updates.
What Should Website Administrators Do?
The PHP security team emphasizes that there are no complete workarounds for these vulnerabilities. Updating PHP is therefore essential.
Administrators should check which version of PHP is running on their servers and install the latest security update immediately. If your website is hosted by a third party, you should verify whether the hosting company has already deployed the patches. Simply updating WordPress, its plugins, or other PHP-based applications will not fix vulnerabilities in the underlying PHP runtime.
Administrators who manage their own servers should also check container images, Linux packages, and any other environments that include PHP. After updating, any affected services should be restarted or redeployed to ensure that the patched runtime is being used.
The official security updates and release notes are available on PHP.net. Given the severity of both vulnerabilities, administrators should not postpone these updates.
