PHP fixed two 9.2-rated runtime bugs, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution without a login.
The PHP project shipped emergency updates on October 21, 2026, for two critical flaws in the PHP engine. The bugs are tracked as CVE-2026-109618 and CVE-2026-109619 and are collectively nicknamed "PHP2Shell." Researchers at Wiz, Calif and OpenAI found and reported them. Either one can let an attacker with no account run code on a web server. The US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert the same day urging organisations to patch at once. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
According to The Hacker News, the PHP team had planned to disclose the vulnerabilities on October 22. Details leaked a day before that date. PHP then published the fixes and advisories around its scheduled release time of 14:00 UTC on October 21.
LWN.net reported that the project released four patched versions, one for each supported branch. It also noted that Linux distributions and other vendors received the patches before the public release, so updated system packages should follow quickly.
CISA's alert described both flaws as allowing unauthenticated remote code execution in PHP. "Remote code execution" (RCE) means an attacker can make the target machine run commands of their choosing over the network. CISA said the flaws affect all PHP installations that serve web requests. It urged defenders to update immediately, starting with systems exposed to the internet.
Before the patch was released, a workaround setting was shared online. PHP core developer Gina Peter Banyard pushed back on the idea that it would be enough. She wrote that "the only mitigation is patching/upgrading PHP." The final release confirmed that the circulated setting was never a complete fix.
The flaws are in the PHP runtime, the software that executes PHP code, not in any particular website or application. As a result, a site can be exposed even if its own code has no bugs. The Hacker News, citing the PHP advisory, reported that even a simple "Hello World" page running on a vulnerable PHP version can be attacked.
Sources describe support for older branches slightly differently. CISA and The Hacker News say PHP 8.1 and earlier no longer receive updates. LWN's wording refers to versions "older than 8.1." All three agree that the project has published source-code patches for PHP 7.4, 8.0 and 8.1 to help vendors and people who build PHP themselves. PHP 8.2 reaches end of life on December 31, 2026.
Both bugs involve PHP handling memory incorrectly between and during web requests. Neither depends on what the application does.
When PHP runs out of its allowed memory (an "out-of-memory" or OOM error), it abandons the current request immediately. NVD's description says some parts of PHP do not plan for this sudden exit. They can leave request data only partly set up. PHP's cleanup routine may then read that half-finished data and treat it as valid. NVD states that several ways of triggering memory exhaustion can reliably cause this condition and lead to code execution.
PHP keeps some global bookkeeping that temporarily points into memory belonging to the current request. In certain cases, that bookkeeping is not properly cleared, or it gets filled in again after being cleared. A later request handled by the same worker process can then use the leftover reference before normal setup resets it, even though the memory it points to has already been freed. This is a classic "use-after-free" weakness, listed as CWE-416 in the CVE record. The Hacker News reports that PHP's session upload progress feature, which is on by default, plays a part in one confirmed attack path.
The Hacker News also reports that an attacker can read memory from a PHP worker without first achieving code execution. That memory may contain passwords, login tokens, API keys and certificates belonging to other users' requests. The researchers demonstrated this against applications they did not control.
ITVedas' CVE database, drawing on NVD and CISA, rates both vulnerabilities 9.2 (Critical) on the CVSS v4.0 scale. CVSS is the standard 0–10 severity score for vulnerabilities.
How easy the bugs are to exploit depends on the server setup:
Reporting differs on whether attacks have begun. CISA said it had not observed exploitation when it published its alert, and neither CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalogue. The Hacker News, however, reports that Cloudflare said before the patch shipped that it was seeing early exploitation attempts and was adjusting its protections. These accounts can both be true. "Attempts" spotted by a network provider are not the same as confirmed, successful compromises recorded by CISA.
memory_limit=-1, a low post_max_size and request-size limits at the web server or proxy. It warns against relying on RLIMIT_AS or RLIMIT_DATA. For CVE-2026-109619, it suggests session.upload_progress.enabled=0 plus a worker restart, and fatal_error_backtraces=0 on PHP 8.5. None of these is a full fix.ITVedas analysis: Because these flaws sit beneath every PHP application, being careful at the application level offers no protection, and only patching the runtime does. With the details already public and attack attempts reportedly underway, organisations should treat old and forgotten PHP installations as an urgent risk rather than routine maintenance.
Want to understand the technology behind this story? ITVedas has beginner-friendly guides on every IT topic.
Explore IT Chapters →