php2shell: PHP's Pair of Critical Remote-Code-Execution Bugs and Why Every Site Must Patch

On October 21, 2026, the PHP project shipped emergency releases — 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — to close two critical flaws the security community now knows as "php2shell." Both let an unauthenticated attacker run arbitrary code on a server running PHP. Both carry a CVSS v4.0 score of 9.2. And because PHP is the backend for roughly seven out of every ten websites, this is one of the largest remote-code-execution exposures in years.

Here's what the bugs are, who's at risk, and what to do about it today.

Two bugs, one theme: memory that outlives its owner

The first, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), lives in how PHP handles out-of-memory errors. PHP enforces its memory_limit by aborting any request that exceeds it. Do that at exactly the wrong moment — say, while a file upload is being parsed — and PHP can be interrupted with internal request data only half-initialized. Cleanup then treats that garbage as valid and frees memory it never owned. That memory can still hold attacker-controlled data, which is the foothold for remote code execution.

The second, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), is a stale-state bug. Request-owned internal state can survive after the memory behind it has been freed, typically after a fatal error. A later request handled by the same long-lived worker can reach for that freed memory before initialization resets it — a classic cross-request use-after-free.

Both are unauthenticated. You don't need to be logged in, and you don't need an account on the application. On Apache with mod_php, the highest-risk setup, a demonstrated exploit fires a single request that triggers the bug before any application code runs at all.

The reach is enormous

PHP is used by 69.1% of all websites whose server-side language is known, according to W3Techs. Every setup that serves web requests is affected — PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed. If you run WordPress, Drupal, Laravel, or any custom PHP, the risk is real regardless of which framework sits on top, because the flaw is in PHP itself, not an application.

The scariest detail is version spread. Yes, PHP 8 accounts for about two-thirds of PHP sites — but PHP 7 is still around 26%, and those older branches are precisely where there's no upstream fix. PHP 8.1 and earlier are end-of-life and no longer receive security updates from the project. For them, the PHP team published minimal source backports for 7.4, 8.0, and 8.1 as a last resort for teams building from source — a much smaller point of support than most hosts are used to.

Update first, then everything else

The PHP security team is blunt: there are no complete mitigations; updating is the only safe choice. Do that first. Upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 — and note that if you're on 8.2, that branch reaches end-of-life on December 31, 2026, so it's also your cue to plan the next bump.

A few practical notes:

• Get packages from your distribution, not a source build. Linux vendors received patches ahead of release, but a patched build can keep an older version number — verify the distro's advisory, not just php -v.
• Check the version on every host and image. Scan results alone won't confirm a fix.
• EOL is not patched. On 8.1 or older, upgrade now or pull a backport from your LTS vendor. CISA explicitly says to take unsupported PHP installs offline until they're fixed.
• If you can't patch immediately, the advisories list mitigations (like memory_limit=-1, a low post_max_size, and disabling session.upload_progress), but treat those as delay tactics, not safety.

Why the urgency

Proofs of concept are already circulating, and CERT-EU warns that attackers are likely exploiting these right now. CISA moved quickly, adding both CVEs to its Known Exploited Vulnerabilities catalog on October 26.

This isn't a repeat of Heartbleed — different bug, different decade of PHP, a different failure mode. But it's the same lesson: when a critical RCE lands in software that powers most of the web, the only safe posture is to patch first and debate the philosophy of it later. Check your version tonight.