PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline

What it is

PHP2Shell is a pair of memory-safety flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. PHP shipped fixes on 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare reports attack traffic, including payloads modified to evade its protections. The NSA advised taking affected systems offline until fully mitigated, and CERT-EU advised isolating them from public networks if they cannot be patched.

How it works

Both flaws involve PHP mishandling memory when requests fail.

• CVE-2026-109618: an out-of-memory error interrupts work before internal data is fully initialized. During cleanup, PHP treats that unfinished data as valid.
• CVE-2026-109619: internal state survives after the memory it references is freed. A later request handled by the same worker can use the stale references.

flowchart TD
    A[Unauthenticated request] --> B{SAPI}
    B -->|Apache mod_php| C[Confirmed exploit runs before app code]
    B -->|PHP-FPM| D[Worker exits on some startup failures]
    D --> E[mod_php startup sequence blocked]
    D --> F[Separate code-execution path during app execution]

Preconditions / Affected

PHP's advisory puts every installation serving web requests at risk: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Researchers identified affected paths back to PHP 5.4. Apache mod_php is the highest risk, because the exploit fires before any application code, so a well-maintained application is still exposed. FPM blocks the demonstrated mod_php sequence, but researchers confirmed a separate FPM code-execution path, so FPM is not a reason to skip the update. Wiz also describes remote memory disclosure that can expose passwords, tokens and API keys without code execution.

About 48.5% of PHP sites in W3Techs' 21 October data run branches without routine upstream security updates. That figure is a calculation from major-version and PHP 8 subversion shares, not a count of vulnerable servers.

What to do

• Update the PHP runtime that serves web requests. Updating WordPress, a plugin or a framework does not fix this.
• Restart the relevant services and long-running workers after the update.
• On managed hosting, confirm the provider has applied the fix.
• On older branches, ask the distribution or support vendor for a backport. PHP also published minimal source backports for 7.4, 8.0 and 8.1, for people building from source. They are not a return to regular support.
• If you cannot patch, take the site offline or isolate it, as the NSA and CERT-EU advise.
• Cloudflare WAF rules are available to all customers, including free plans, as a stopgap.

Caveats

Cloudflare's Dane Knecht called the WAF rules "a STOPGAP only." PHP's advisory lists temporary configuration changes, but they only reduce exposure on particular attack paths. A patched runtime is the only complete fix.

The leak was an unverified 20 October Hacker News post that claimed a 10.0 score and a 22 October disclosure. PHP's official score is 9.2. PHP 8.2 reaches end of life on 31 December 2026, so patching that branch now leaves about two months before it loses upstream fixes.