If you run a website, there’s a good chance PHP is somewhere in your stack. That makes the last 48 hours worth your attention. The PHP project has shipped emergency security releases for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both can let an attacker run code on a vulnerable server without signing in.
One correction to some of the early headlines. Many reports said administrators should “prepare for upcoming patches.” That stage has passed. The PHP team has released emergency updates in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and is urging everyone to update immediately. This is no longer a “get ready” situation. It’s a “patch now” situation. helpnetsecurity
The short version
- What: Two flaws in the PHP engine itself, not in any one plugin or app. Both are rated CVSS v4.0 9.2. sansec
- Impact: Remote code execution on web servers without authentication. helpnetsecurity
- Fix: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. helpnetsecurity
- Mitigations: PHP’s own release notice says there are no complete mitigations and that updating is the only safe choice. github
- Exploitation: There are reports of attacks in the wild, covered below.
What actually went wrong
You don’t need to be a memory-safety expert to understand the shape of this bug.
PHP handles each web request in a fairly self-contained way. It sets up internal state, runs your code, then cleans up. The two vulnerabilities come from that cleanup going wrong when something fails badly in the middle of a request.
According to published analyses, a fatal error during a request, typically running out of memory when a request crosses the memory limit, interrupts native PHP code before it cleans up. A later request, or a reused worker, then treats the freed memory as live data. sansec
The two CVEs are two flavors of that problem:
- CVE-2026-109618 is remote code execution through out-of-memory corruption: PHP can be interrupted while internal request data is only partly initialized, and cleanup may then treat the invalid data as valid. helpnetsecurity
- CVE-2026-109619 is remote code execution through stale global state: request-owned internal state can survive after the memory behind it has been freed. helpnetsecurity
Researchers describe both with a “use-after-free” pattern. In plain terms, the program keeps using a piece of memory after it has been handed back and possibly reused. Attackers who can control what ends up in that memory can steer the program into running their instructions.
Different write-ups describe the technical details slightly differently. This is a fast-moving story, so read the official PHP advisory for the authoritative version.
Why this one is unusually dangerous
Most PHP security headlines involve one popular plugin, a badly written theme, or a misconfigured admin panel. PHP2Shell is different for three reasons.
1. It sits below your application. Because the flaw is in the runtime, Magento, Shopware and WooCommerce stores are affected even when their own code is clean. The same researchers reported that an unauthenticated attacker can run code on a long list of well-known PHP applications, including WordPress, Drupal, Joomla, MediaWiki, Roundcube, phpMyAdmin and Nextcloud. Careful coding and a perfect plugin audit don’t protect you here. sansec
2. It can trigger before your code runs. A working exploit has already shown that a single unauthenticated request can trigger the attack before any application code runs. Your web application firewall rules, login pages and input validation are all downstream of the problem. helpnetsecurity
3. It’s old and widespread. All PHP versions from 5.4 through 8.5.11 are listed as vulnerable. The vulnerable code reportedly goes back to PHP 5.4.0, released in 2012. That’s more than a decade of installations, including many nobody has touched in years. googlesansec
Who is at risk?
Short answer: almost anyone who serves web pages with PHP.
Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php setups facing the greatest danger. helpnetsecurity
That covers a wide range of people:
- Small-business owners on shared or managed hosting with WordPress or WooCommerce
- Agencies managing dozens of client sites on one server
- E-commerce operators running Magento, Shopware or similar platforms
- Developers and DevOps teams with PHP baked into Docker images and CI pipelines
- Anyone self-hosting tools like Nextcloud, Roundcube or phpMyAdmin
- Organizations with forgotten legacy apps on old PHP versions
If you’re on a hosting control panel, check your vendor’s guidance. Plesk, for example, confirmed that all PHP versions it ships are affected, and published a table of fixed builds. plesk
The end-of-life problem
This is the hardest part of the story. The PHP project is not releasing fixes for PHP 8.1 or earlier, which have reached end of life. google
If you’re on PHP 7.4, 8.0 or 8.1, upstream won’t be shipping you a patch. That doesn’t mean you’re completely stuck. Some vendors are backporting fixes. Plesk, for instance, lists rebuilt EOL packages for 8.1, 8.0 and 7.4. But that’s vendor-specific, and you need to confirm your provider is doing it for you.
The real fix for these setups is to migrate to a supported PHP version, and this incident is a good reason to stop postponing it. Running an unsupported runtime means that when something like PHP2Shell appears, you may be left waiting on a third party, or on nobody.
The timeline: a leak made things worse
Normally, a vulnerability like this follows coordinated disclosure: researchers report it privately, the vendor patches it, and details go public once fixes exist. This time the order got scrambled.
According to a published timeline:
- August 2026: Calif found multiple RCE paths and reported the first bug to PHP on August 11. Wiz Research reported the vulnerabilities to PHP on August 24. sansec
- October 20: Details of the two vulnerabilities leaked online before the coordinated disclosure and before patches were released. watchTowr confirmed remote code execution in PHP. huntress
- October 21, morning: Cloudflare reported early attacks. sansec
- October 21, 14:00 UTC: PHP released the fixed versions, and the researchers and PHP disclosed publicly. sansec
That sequence explains the whiplash in the news cycle. First there were vague warnings about “upcoming patches,” then a leak, then confirmed attacks, then the release. For defenders, it means the window between “no one knows” and “attackers are scanning” was very short.
Is it being exploited?
Treat it as yes. One security vendor’s FAQ lists both CVEs as exploited in the wild, according to watchTowr. Combined with Cloudflare’s report of early attacks, the safe assumption is that automated scanning is underway or imminent. Public exploit details plus a huge pool of vulnerable servers is the pattern that usually produces mass exploitation within days. watchtowr
I’d stay careful about specifics. Exploitation reports for a story this new are still being sorted out, and some scope claims (such as how far back affected versions go) have come from different researchers with different levels of confirmation. The practical advice doesn’t change with the details: patch first, investigate second.
What to do right now
1. Find every PHP instance you own
Run php -v on servers, but also check places people forget:
- Docker base images and anything built from them
- CI/CD runners and build containers
- Staging and dev servers
- Old VPS instances running a single forgotten site
- Hosting-panel PHP builds that run separately from the system PHP
2. Update to a fixed version
Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. Then restart PHP-FPM, Apache, or whatever serves your requests. A patched package on disk doesn’t help if the old process is still running.
3. Rebuild containers and images
Pulling a new package on a running container doesn’t fix your images. Rebuild from a patched base image and redeploy through your pipeline. Cached layers can quietly keep the vulnerable version alive.
4. Check with your host or vendor
If you’re on shared hosting, managed WordPress, or a control panel, don’t assume it’s handled. Ask your provider whether they’ve patched and when.
5. Plan the migration off EOL PHP
If you’re on 8.1 or earlier, find out whether your distribution or hosting vendor has backported the fix. Either way, put migration to a supported branch on the roadmap with a date attached.
6. Use stopgaps with caution, if at all
Some hosting providers have published interim settings to reduce exposure until patching is done. One example disables session upload progress, removes the PHP memory limit, and turns off fatal-error backtraces. These come with real trade-offs. Removing the memory limit lets a single request consume all available memory, which is a risk in its own right. They are temporary measures at best. PHP itself says updating is the only safe choice. sevallagithub
7. Look for signs of compromise
After patching, review:
- Unexpected new files in web-accessible directories (especially recently modified
.phpfiles) - Unusual outbound connections from your web server
- New or modified cron jobs
- Odd spikes of memory-exhaustion errors or fatal errors in your logs around October 20–22
- New admin users or changed credentials in your CMS
Because the attack can hit before application code runs, application-level logs may show nothing. Web server access logs, process monitoring and file-integrity checks are more reliable. If you find signs of compromise, treat the server as untrusted: rotate secrets, restore from a known-good state, and don’t just delete the suspicious file.
What this means for site owners
A few takeaways go beyond this one incident.
Your runtime is part of your attack surface. Most security advice focuses on plugins, passwords and application code. PHP2Shell is a reminder that the layer underneath matters just as much, and that you need a way to update it quickly.
Patch speed is now a competitive advantage. The gap between a leak and active exploitation is measured in hours. If your update process takes weeks of approvals, you will always be exposed during the window that counts.
End-of-life software is a liability with a deadline. There’s no patch coming for old versions. The cost of migrating later is always higher than migrating before something breaks.
Don’t wait for perfect information. Early coverage of this story was messy, with leaks, partial details and conflicting scope claims. The right response was to prepare, and now to patch, without waiting for every detail to settle.
So
PHP2Shell is among the more serious PHP security events in years, mainly because it hits the runtime itself and works without authentication. The patches are available now for the supported branches. If you run PHP anywhere, find your instances, update to a fixed release, restart your services, and check for signs of compromise. If you’re stuck on an unsupported version, make migration your next project.
For the authoritative details, check the official PHP security advisory and your hosting or platform vendor’s guidance, as the situation is still developing.
