Critical PHP core remote code execution vulnerabilities (CVE-2026-109618 / CVE-2026-109619, PHP2Shell): impact and recommended actions

The PHP project released security updates on 21 October 2026 for two critical vulnerabilities that allow an unauthenticated attacker to execute code remotely (RCE). Known in the industry as PHP2Shell, the flaws sit in the PHP interpreter itself rather than in WordPress or any plugin, so updating the application alone will not fix them. We recommend treating this as top priority, starting with internet-facing servers. The summary below is current as of 22 October 2026.

1. Vulnerability summary

CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) stems from the way PHP handles running out of memory. If PHP is interrupted while request data is only partly initialised, the cleanup that follows treats that invalid data as valid, which leads to memory corruption and can be abused to run code. CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) is a stale-state flaw: request-owned internal state survives after its memory has been freed, so a later request handled by the same worker may reuse it and reach RCE.

Both score 9.2 (Critical) on CVSS v4.0. PHP considers Apache mod_php the highest risk, because an unauthenticated request has been shown to trigger the attack before any application code runs, so login pages and application-layer controls offer no protection. Several vendors report probing and attack traffic, and research shows that PHP worker memory can be read, which may expose passwords, tokens and API keys. Sansec expects mass attacks within minutes of the patch going public, although that is a forecast rather than a measurement.

The vulnerabilities were found by Calif, OpenAI and Wiz. According to Calif, its researcher discovered the issue on 1 August 2026, began coordinated disclosure with PHP from 11 August, shared a proof of concept on 14 August, and PHP confirmed it worked on 15 August; the patched releases followed on 21 October. Calif also notes that related memory-limit problems date back to 2004, and that bug #78876 (2020) and the 2024 OSTIF and Quarkslab audit both touched on related out-of-memory behaviour without proving it exploitable. Calif has published a demonstration video, and another vendor reports that exploit tooling leaked as screenshots, so we assess that the barrier to attack is falling quickly.

2. Affected versions

• PHP project: Every PHP installation serving web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
• Singapore CSA and CERT-EU: All versions from PHP 5 onwards may be affected.
• UK NCSC: Organisations using any version of PHP are affected.
• Calif:     The earliest affected code path dates to PHP 5.4.0 and is exploitable under default configurations; the usable attack paths depend on the PHP version and SAPI.
• CrowdStrike: Both flaws are present in every release of the PHP 7.x and 8.x series. The HashTable ordering behind CVE-2026-109618 was introduced in October 2017 and first shipped in PHP 7.3.0 (December 2018); the serialisation and session paths behind CVE-2026-109619 date back to PHP 7.1 and PHP 5.4 respectively. Conclusion: no supported branch is unaffected.
• Supported branches that need updating: 8.5.11 and below, 8.4.26 and below, 8.3.35 and below, 8.2.34 and below.
• PHP 8.1 and older: No longer receive updates from upstream.

Calif confirmed unauthenticated RCE on the following common applications:

• WordPress: 7.1.2
• Drupal: 11.4.3
• Joomla: 6.1.4
• MediaWiki: 1.46.2
• Roundcube    : 1.7.4
• Magento: 2.4.9
• phpMyAdmin: 5.2.3
• Nextcloud: 35.0.1
• Laravel: 13.11
• Symfony: 8.1
• WHMCS: Version not specified
• 
  

Please do not assume that PHP-FPM is safe. It terminates the worker when request startup fails, but Calif still demonstrated application-dependent attack paths under PHP-FPM (for example with phpMyAdmin and WordPress), and the PHP project confirms that FPM also needs the patch.

3. Fixed versions

For more details please check the document or contact us.