On October 21, 2026, the PHP project released fixes for two critical vulnerabilities that can lead to remote code execution: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. Every PHP installation that serves web requests is affected. The fix is to upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you use shared hosting, ask your provider whether the update has been applied.
What Happened
PHP announced a critical security release on October 20 and published updates for all four supported branches the next day. According to the official advisory, the vulnerabilities affect PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php, where an unauthenticated request can trigger the attack before any application code runs. Some media reports call the pair “PHP2Shell”; the PHP advisory does not use that name.
The Two Vulnerabilities
| CVE | What goes wrong | Impact |
|---|---|---|
| CVE-2026-109618 | When PHP runs out of memory, it can interrupt a request while internal data is only partly initialized; cleanup then treats that invalid data as valid | Remote code execution |
| CVE-2026-109619 | State owned by a request can remain reachable after its memory is freed, and a later request on the same worker may use it | Remote code execution |
Full details are in PHP's GitHub security advisories. CDN provider bunny.net published WAF rules that match known request patterns, such as deeply nested multipart field names and the default session upload-progress field, but stressed that these are not a substitute for patching. Update (October 23, 2026): security firms now report exploitation attempts and attacks. Amazon Threat Intelligence says it saw an attempt on October 17, before disclosure, and that the flaws are now broadly exploited; watchTowr reports exploitation in its honeypot network since October 21. CISA had not added the CVEs to its Known Exploited Vulnerabilities catalog as of October 22. Patch now, restart all PHP workers, and check servers patched after October 21 for web shells, new cron jobs or accounts, and unexplained outbound connections.
Which Version Do You Need?
| Your branch | Safe version | Note |
|---|---|---|
| PHP 8.5 | 8.5.12 or later | |
| PHP 8.4 | 8.4.27 or later | |
| PHP 8.3 | 8.3.36 or later | |
| PHP 8.2 | 8.2.35 or later | End of life on December 31, 2026 |
| PHP 8.1, 8.0, 7.4 and older | No official release | Upgrade; minimal source backports and distribution/LTS patches exist |
PHP 8.1 and older no longer receive releases from the PHP project. The security team published minimal source backports for 7.4, 8.0 and 8.1, and some Linux distributions and long-term support vendors ship patched packages. Moving to a supported branch is the safest option.
How to Check Which PHP Version a Site Runs
- Hosting panel: cPanel shows it under “Select PHP Version” or “MultiPHP Manager”; Plesk under the domain’s “PHP Settings”.
- WordPress: Tools → Site Health → Info → Server lists the PHP version.
- Server shell:
php -vshows the command-line version. The web server may use a different build, so check PHP-FPM or the Apache module separately, for example with a temporaryphpinfo()page that you delete straight afterwards. - From outside: some servers reveal the version in an
X-Powered-By: PHP/8.x.yheader, which you can see with our HTTP headers tool. A missing header does not mean the site is not running PHP. Hiding it is good practice anyway; see the HTTP security headers checklist.
What Site Owners Should Do
- Upgrade PHP and restart PHP-FPM workers or the web server, then confirm the running version actually changed.
- On shared hosting, ask your provider to confirm the update, and switch the site to a patched branch in the control panel if an old version is selected.
- If you cannot update immediately, PHP lists partial mitigations such as disabling
session.upload_progress.enabledif you do not use it and loweringpost_max_size. PHP is explicit that these do not make an installation safe and that updating is the only complete fix. - Keep WAF protection on if you are behind a CDN or proxy with managed rules. It is an extra layer, not a fix.
- Look for signs of compromise: unexpected files, new admin accounts or strange redirects. If you find any, rotate credentials and consider restoring from a clean backup. Check external reachability after maintenance with Is My Site Down.
Sources: official PHP security advisory (October 21, 2026) and bunny.net. This post will be updated as new information is published.
Common Questions
Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619?
All PHP installations serving web requests. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older receive no official releases.
Is my WordPress site at risk?
WordPress runs on PHP, so the site is exposed if the server’s PHP has not been patched. Check the version under Site Health and ask your host to confirm the update.
Are these vulnerabilities being exploited?
As of October 23, Amazon, watchTowr and Cloudflare report exploitation attempts and attacks, while CISA had not listed them as known exploited as of October 22. Assume unpatched servers are being targeted and patch without delay.
What is PHP2Shell?
A name some media use for CVE-2026-109618 and CVE-2026-109619. The official PHP advisory does not use it.