PHP2Shell: patch CVE-2026-109618 and CVE-2026-109619

The PHP Security Team disclosed two vulnerabilities on 21 October 2026, after details leaked ahead of the coordinated release on 20 October. Both are tracked as CVE-2026-109618 and CVE-2026-109619. PHP scored each 9.2 on CVSS v4. The nickname in the advisories is PHP2Shell.

The bugs are in the engine that serves web requests, not in a single application. A framework's input checks do not sit in front of them when the failure happens before application code runs.

What the two CVEs are

CVE-2026-109618 is a use-after-free on the path where a memory allocation fails while a request is starting, and later cleanup trusts state that was only half built. CVE-2026-109619 is a use-after-free where a worker keeps global state that still points at memory from a request already finished. PHP's advisory says either one can lead to remote code execution without a login.

NVD scored the first 9.8 and the second 8.1 under CVSS 3.1. A 10.0 figure circulated before release. The PHP Foundation said the score it stands behind is 9.2. Use the vendor score when you rank the work, and the CISA listing when you rank the urgency.

Which PHP installs are exposed

The advisory names every PHP that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers mod_php the highest risk because an unauthenticated request can reach the bug before any application code runs. The corruption path of the first bug is described as present since PHP 7.3.0, and the stale-state path since PHP 5.4.0. Branches older than 8.2 are outside security support.

CISA's alert of 21 October, updated on 26 October, says the same scope and adds that both CVEs entered the Known Exploited Vulnerabilities catalog on 26 October 2026, with a federal deadline of 29 October. Cloudflare reported a large burst of attempts within the first hour after the announcement. Seeing probes is not the same as a confirmed breach of your host. It is a reason to patch the same day.

The releases that fix it

Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, matching the branch you already run. PHP 8.2 reaches end of life on 31 December 2026, so a host that can move to 8.3 or newer should plan that move alongside the security update, not instead of it.

PHP published workarounds for teams that cannot restart yet. The project says those measures cut specific paths and do not make an install safe. The complete fix is the version bump, followed by a restart of php-fpm or Apache so the old binary is actually gone.

What to do after the package is updated

Find every interpreter, not only the one in the main site. Cron images, old admin panels and vendor appliances often ship their own PHP. The WaterISAC note of 29 October pointed at internet-facing panels — Joomla, Laravel, XWiki and others — as the places attackers already look.

After the restart, read the access log for the days since 17 October, when Amazon reported an early probe, and treat unexpected admin files or new scheduled tasks as an incident. Rotating secrets that the application can read is reasonable if the host was exposed and you cannot prove the probes failed. This article does not describe how the bugs are triggered.

CISA's alert, updated 26 October 2026, and the PHP security release of 21 October 2026.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching