Published: October 22, 2026
Two critical security vulnerabilities have been discovered in PHP, potentially allowing attackers to execute malicious code on vulnerable web servers without logging in.
Disclosed on October 21, 2026, the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Collectively referred to in security reporting as PHP2Shell, they affect PHP’s core runtime rather than just a specific PHP application or plugin.
Both vulnerabilities carry a CVSS score of 9.2 out of 10, making immediate patching a priority for website owners, hosting providers, and server administrators.
1. CVE-2026-109618 — Remote Code Execution Through Out-of-Memory Corruption
The first vulnerability involves how PHP handles an out-of-memory condition.
When PHP runs out of memory while processing a request, some internal request data may not be fully initialized. During cleanup, PHP can mistakenly treat this incomplete data as valid.
Under the right conditions, an attacker can exploit this memory-handling flaw to execute malicious code on the affected server.
Potential impact:
- Unauthorized execution of code on a vulnerable server.
- Potential compromise of the website and its underlying system.
- Possible access to sensitive data or server resources, depending on the environment.
How to fix it:
Upgrade PHP to a patched release:
- PHP 8.5.12 or later patched release
- PHP 8.4.27 or later patched release
- PHP 8.3.36 or later patched release
- PHP 8.2.35 or later patched release
Use the official PHP advisory and your operating system or hosting provider’s security updates to confirm the appropriate package.
2. CVE-2026-109619 — Remote Code Execution Through Stale Global State
The second vulnerability concerns internal PHP state that can outlive the memory it depends on.
In certain circumstances, PHP may retain request-related state after its backing memory has been freed. A later request handled by the same worker may encounter that stale state before normal initialization resets it.
This can create a memory-safety issue that an attacker may exploit to execute malicious code remotely.
Potential impact:
- Remote code execution under vulnerable conditions.
- Potential compromise of PHP worker processes.
- Risk to website data and server resources if exploitation succeeds.
How to fix it:
Install the corresponding patched PHP release: 8.5.12, 8.4.27, 8.3.36, or 8.2.35, as appropriate for your deployment. Restart or redeploy the affected PHP services when required by your hosting environment so the patched runtime is actually running.
Which PHP Versions Are Affected?
PHP’s security advisory warns that all PHP installations serving web requests should be assessed. Security reporting identifies vulnerable versions extending from PHP 5.4 through PHP 8.5.11.
The PHP project has released fixes for these supported branches:
| PHP branch | Patched release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Important: PHP 8.1 and older no longer receive security updates from the main PHP project. Some operating-system vendors may provide backported fixes, so check your vendor’s advisory or migrate to a supported PHP version.
How to Protect Your Website
If you own a WordPress website or run a PHP-based application, follow these steps:
- Check your PHP version. In WordPress, open Tools → Site Health → Info → Server. Your hosting control panel may also display the active PHP version.
- Update PHP. Open your hosting control panel and select a patched PHP release supported by your website. If you manage your own server, update the PHP packages using your operating system’s security repositories.
- Restart or redeploy services if necessary. Confirm that PHP-FPM, Apache, or the relevant runtime is using the patched build.
- Verify the active version. Check the runtime serving your website, not merely the PHP version installed on your local computer.
- Contact your hosting provider if you cannot upgrade PHP yourself. Ask whether the fixes for both CVEs have been applied to your active runtime.
PHP’s security team states that there are no complete mitigations; updating to a patched version is the recommended solution. Do not assume that a firewall or web application firewall alone eliminates the underlying risk.
Final Verdict
These are two serious vulnerabilities in PHP’s core runtime, not ordinary application-level bugs. Since they may allow unauthenticated remote code execution, administrators should prioritize checking their PHP deployments and applying the relevant security updates.
If your website runs PHP, verify its actual runtime version and confirm that both fixes are in place.
Sources
- Official PHP security advisory: https://www.php.net/archive/2026.php
- Official PHP downloads: https://www.php.net/downloads.php
- Google Cloud security guidance: https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
- ENISA joint security statement: https://www.enisa.europa.eu/news/joint-statement-on-critical-php-vulnerabilities
- Wiz Research — PHP2Shell technical analysis: https://www.wiz.io/blog/php2shell-php-rce
