PHP2Shell: two critical PHP flaws allow unauthenticated remote code execution on web servers

On 21 October 2026, the PHP project shipped emergency releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two memory flaws that let an unauthenticated attacker run code on a server through a crafted HTTP request. CERT-FR issued an alert: every PHP installation serving web traffic must be updated, including old 7.x and 8.0–8.1 branches.

What happened

On 21 October 2026 the PHP project published a critical security release, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two remote code execution flaws nicknamed PHP2Shell, each rated 9.2 on CVSS 4.0. CERT-FR published alert CERTFR-2026-ALE-014 the same day. CVE-2026-109618 comes from the way PHP handles running out of memory: the request can be interrupted while its internal data is only partly initialised, and the clean-up step then uses that invalid data. Oversized multipart requests are one way to trigger it. CVE-2026-109619 is a use-after-free: state left over by one request survives in the worker process and is reused by a later request.

Who is affected

According to php.net, every installation serving web requests is concerned: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP advisories say full unauthenticated code execution was validated against mod_php in its default configuration, and against FPM for the second flaw. CERT-FR lists all 5.x, 6.x, 7.x, 8.0 and 8.1 versions as vulnerable; the PHP team made an exception and published minimal source patches for 7.4, 8.0 and 8.1, which are otherwise unsupported. Official sources did not report active exploitation at the time of writing; according to ZATAZ, demonstrations are circulating on forums. WordPress, Drupal, Joomla and in-house applications all run on top of PHP.

What to do now

1. List your PHP versions on every server and container: php -v, and check the version actually used by the web server (FPM pool, Apache module).
2. Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or install your distribution's fixed packages (apt update && apt upgrade, dnf upgrade 'php*'), then restart PHP-FPM or Apache so that no old worker keeps running.
3. If you cannot patch today: set session.upload_progress.enabled = Off in php.ini, as CERT-FR recommends, and set fatal_error_backtraces to Off; the PHP team warns these settings do not cover every attack path.
4. On 7.4 to 8.1: apply the backports or your vendor's patches now, and plan the move to a supported branch (8.2 itself ends on 31 December 2026).
5. Watch your logs for PHP worker crashes, out-of-memory errors and unexpected files in web directories.

Our take

PHP sits under a large share of business websites, often in versions nobody remembers installing. These flaws are a reminder to keep an inventory of runtimes, not only of applications, and to treat end-of-life PHP branches as a risk to remove, not a legacy to put up with.

Sources

• PHP — Critical security release: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
• CERT-FR — CERTFR-2026-ALE-014 : Multiples vulnérabilités dans PHP
• PHP (GitHub security advisory) — RCE via OOM corruption
• PHP (GitHub security advisory) — RCE via stale global state
• ZATAZ — PHP2Shell : deux failles critiques menacent les serveurs web

How we choose, verify and write our analyses →