php2shell: Emergency PHP Patches for CVE-2026-109618 and CVE-2026-109619

On October 21, 2026, the PHP development team released emergency security patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively nicknamed php2shell. Both are rated CVSS 9.2 and both are the kind of flaw that should be treated as urgent rather than scheduled: they are memory-safety and remote code execution issues in PHP core that allow an unauthenticated attacker to run code on an exposed server. It affects active branches and, at least for older installations, unsupported versions too.

The Two Vulnerabilities

The two CVEs are separate bugs that share a common theme: PHP core mishandling internal state while a request is in an unusual condition. Both were fixed in the same emergency release.

CVE-2026-109618 — Out-of-Memory Corruption

This one involves PHP's out-of-memory handling. When a request exhausts available memory, PHP interrupts execution part-way through processing, at a point where request data is only partially initialized. Under certain conditions the cleanup routines that run during that interruption treat that half-built, invalid data as if it were valid. The result is memory corruption caused not by an attacker sending malformed data directly, but by an attacker driving the server into a memory-exhaustion state at a moment of their choosing.

CVE-2026-109619 — Stale Global State

The second flaw is a lifetime problem. Internal state that belongs to a specific request survives after the memory backing it has already been freed. That is a heap use-after-free. Because the stale state is reachable on a subsequent request, an attacker can potentially shape what occupies that freed memory and influence execution — with remote code execution as the worst-case outcome. This class of bug is particularly dangerous in persistent server models, where a worker process handles many requests in sequence.

How the Flaws Were Found

The discovery was assisted by AI models, including work from Google-owned Wiz and partners associated with OpenAI and California-based researchers, according to the release notes accompanying the fix. The details leaked before an orderly disclosure window could complete, which is what triggered the emergency release cadence rather than a scheduled patch Tuesday-style rollout. In practical terms that means exploits may be developed faster than usual, and the window between disclosure and exploitation is shorter than a normal patch cycle assumes.

Required Action: Patch to an Official Release

Upgrade to one of the official security releases below. These are the fixed versions for each active branch; anything older in the same branch is still vulnerable.

Only the active branches — PHP 8.2 and newer — receive official vendor patches. Legacy versions from PHP 5 through 8.1 are end-of-life and will not receive official core fixes. If you are still running one of those, "wait for a patch" is not an option that exists. The realistic choices are upgrading the application or containing it.

If You Cannot Patch Immediately

Agencies including CERT-EU recommend containment when immediate patching is not possible. Containment is not a fix, and it should be treated as a short-term bridge with a real deadline attached.

• Isolate internet-facing applications running affected PHP builds — put them behind an access restriction, a private network, or a maintenance page until the update lands.
• Put a Web Application Firewall in front of the application. Cloudflare rules and equivalent WAF products can block known exploitation patterns, but they are pattern-based and should never be the only control.
• Restrict the application to known source IP ranges where the audience allows it. For internal tools, this alone can remove the exposure completely.
• Disable or remove unused PHP applications, test installs, staging environments, and forgotten admin panels. The easiest vulnerable endpoint to protect is the one you delete.
• Watch for exploitation attempts in web server and PHP logs while you are in this state, and treat any unexplained outbound traffic or new process as suspicious.

Where PHP Is Hiding in Your Environment

The most common reason a business stays exposed after a PHP advisory is that nobody knows where PHP actually runs. It is rarely just the website.

• Content management systems: WordPress, Drupal, Joomla, and most legacy CMS installations run on PHP and inherit the host runtime version.
• Custom and agency-built web applications, including older sites that nobody has touched in years but that are still publicly reachable.
• Webmail, ticketing, invoicing, CRM, and helpdesk tools deployed on your own server rather than as SaaS.
• On-premise line-of-business applications with a web interface — inventory, scheduling, time clock, and reporting tools are frequent offenders.
• Development and staging servers, which are commonly internet-facing, rarely patched, and often share the same codebase as production.

Shared Hosting, Managed Hosting, and Containers

If your site lives on managed WordPress hosting or a shared host, the runtime is the host's responsibility — but the confirmation is yours. Ask your provider directly which PHP version each site is running and whether the fixed release has been deployed. "We handle updates" is not the same as "your site is on 8.4.27 today".

• Check whether your plan lets you pin a PHP version. If it does, confirm the pinned version is one of the fixed releases, not a frozen older build.
• For containerized workloads, check the base image tag. A pinned php:8.3-fpm image will stay vulnerable until you rebuild on a patched tag and redeploy — updating the host does nothing.
• For virtual machines and self-managed servers, the update must be applied inside the instance and the PHP-FPM or Apache service restarted before the fix takes effect.

Verifying the Patch Actually Landed

Installing the package and running the new code are two different things. A restart that never happened, or an old worker pool still serving traffic, is a very common false sense of security.

1. 1Confirm the installed version reports one of the fixed releases, for example by running php -v on the command line.
2. 2Restart PHP-FPM, Apache, or your application server so the new binary is actually loaded by the running processes.
3. 3Confirm the web-facing runtime matches — a phpinfo page or an application status endpoint may show a different version than the CLI.
4. 4Repeat the check on every server in the pool and every container replica, not just the first one.
5. 5Keep a record of the version and the date it was verified, so you can answer the question in an audit or a client security review.

Questions Worth Asking Your IT Provider This Week

• Which of our systems run PHP, and what version is each one on right now?
• Do we have any PHP 8.1 or older installations still in service? What is the upgrade plan for them?
• Are our internet-facing applications patched, and has the service been restarted since?
• Is anything exposed to the internet that does not need to be — staging, dev, admin panels, old sites?
• Do we have logging that would show an exploitation attempt against a PHP endpoint?

Why This One Deserves Priority

Businesses tend to triage security advisories by how noisy the news is rather than how reachable the bug is. This one sits at the intersection of everything that makes a vulnerability expensive: it is unauthenticated, it is remotely reachable, it leads to code execution, it affects the runtime that powers a large share of the web, and the details leaked early enough that exploitation research may already be underway. Patching a PHP runtime is usually a short maintenance window — far shorter than the recovery from a compromised web server, which typically means rebuilding from a known-good state, rotating every credential the application could touch, and evaluating notification obligations.

This article summarizes the October 21, 2026 PHP security release for business decision-makers. Always confirm version numbers and remediation guidance against the official PHP release announcement before acting, since details can be revised as analysis continues.