PHP2Shell: Critical Unauthenticated RCE Flaws in PHP (CVE-2026-109618 / CVE-2026-109619)
Two critical PHP flaws dubbed "PHP2Shell" allow unauthenticated remote code execution on PHP installations serving web requests. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now; PHP 8.1 and older get no upstream fix.
On 21 October 2026, the PHP project released emergency security updates for two critical vulnerabilities collectively known as PHP2Shell: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Both allow an unauthenticated attacker to execute arbitrary code by sending crafted web requests to affected PHP workers.
What is affected
All PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates the risk as greatest for mod_php, where a demonstrated exploit triggers the bug before any application code runs.
- CVE-2026-109618 – memory corruption during request cleanup triggered by out-of-memory conditions.
- CVE-2026-109619 – stale request state leading to a use-after-free.
| Branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 5.4 – 8.1 | No upstream fix (end-of-life) |
What to do
CISA, the Canadian Centre for Cyber Security and NCSC-NL urge organisations to:
- Inventory every system running PHP, including appliances, containers and products that bundle PHP.
- Patch immediately, internet-facing systems first.
- If you cannot patch, apply PHP's temporary mitigations (e.g. disabling
session.upload_progress, restarting workers, reviewingmemory_limit/post_max_size) – these are not complete fixes – and consider taking unpatched systems offline. - Monitor for PHP worker processes spawning shells or downloading tools.
A proof of concept has been publicly reported, so the window for safe delay is short. Sites still on PHP 8.1 or older must rely on vendor backports or migrate to a supported branch.
Sources: CISA, AWS bulletin, Canadian Cyber Centre, NCSC-NL.
If you're stuck on PHP 8.1 or older, RescuePHP can help with emergency backported patches or a planned upgrade to a supported release.