The PHP security team released emergency updates on Wednesday, October 21, fixing two critical remote code execution vulnerabilities tracked together as PHP2Shell. The flaws, CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 on the CVSS v4.0 scale, and CISA is urging organizations to patch immediately, prioritizing internet-facing systems.
Both flaws allow an unauthenticated attacker to run code on a vulnerable server with the privileges of the web worker account. The PHP team said every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where a demonstrated exploit can be triggered by a single unauthenticated request before any application code runs.
The two bugs share a root cause in memory handling. According to the PHP team, PHP can leave its memory in a corrupted state when a request ends abnormally. CVE-2026-109618 exploits a chain of weaknesses that trigger out-of-memory corruption, while CVE-2026-109619 involves stale global state that enables heap use-after-free, memory disclosure and remote code execution in a later request handled by the same worker.
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anyone running PHP 8.1 or older will not receive an official update from the PHP project, although the team provided minimal source backports for PHP 7.4, 8.0 and 8.1 for people building from source or without access to a long-term support vendor. CISA said organizations that cannot update immediately, or that still run unsupported versions, should take PHP-based systems offline until they can be patched or upgraded, and noted that a web application firewall may provide only partial protection in the meantime.
The disclosure was accelerated after details leaked ahead of the planned schedule. Cloudflare said it was already seeing early attacks and updated its firewall rules as a stopgap, warning customers to patch even with those protections in place. CERT-EU, the NSA and agencies in Britain, Japan and Australia issued similar guidance to inventory PHP systems, patch internet-facing assets first, and consider taking sites offline if patching was not possible.
That advice was taken literally in Europe. Reuters reported that several government, school and hospital websites were taken offline on Wednesday as a precaution, including sites run by the Dutch government and by Germany's federal IT provider ITZBund, which said the shutdown was preventive and that no security incidents were known to have occurred.
The scale explains the urgency. PHP powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms and control panels, and it often runs inside other software without being obvious to its operator, as Huntress noted. CISA made the same point, urging organizations to inventory every system running any version of PHP, because its prevalence may not be directly observable, and to monitor for suspicious activity such as PHP worker processes launching shells or downloading tools.
Researchers from Calif, Wiz and OpenAI are credited with discovering the flaws. Reporting by The Wall Street Journal said a Calif researcher uncovered them with help from an advanced OpenAI model during an audit of PHP source code in August, turning a class of bugs long considered too difficult to exploit into a working attack. For defenders, the lesson is simpler: find every PHP instance, apply the fixed release for its branch today, and treat any system that cannot be patched as offline until it can.