On 21 October 2026 the PHP project shipped emergency releases for two flaws it rates as allowing remote code execution without a login. If you run anything on PHP, this is today's job.
What happened
The flaws are known as PHP2Shell: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS 4.0. They sit in PHP itself, not in a particular application.
- CVE-2026-109618: running out of memory can interrupt PHP while request data is only partly set up. The cleanup then treats that invalid data as valid.
- CVE-2026-109619: internal state can survive after its memory has been freed. A later request in the same worker may then use it.
The disclosure did not go as planned. According to Recorded Future, details were circulating hours before the release, and hosting partners were already reporting attacks that morning. How many systems were really compromised is not yet known.
Are you affected?
Probably, if you serve web requests with PHP. The advisory names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project considers mod_php the highest risk, because a demonstrated attack runs before any application code. A login page in front of your application does not help there.
That also covers what you may not think of as PHP: WordPress, Drupal, Joomla and Magento, control panels such as cPanel and Plesk, and appliances with PHP built in. An old NAS or router with a web interface belongs on your list.
What to do now
- Update PHP. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating a CMS or a plugin does not change the PHP runtime.
- Check your vendor's package. Distributions often backport a fix without changing the version number, so read the package's changelog instead of relying on the number alone.
- Restart every worker. Old processes keep running the old code until they are replaced. Containers need a rebuilt image, not only a restart.
- Check what is really running. The command line and the web server can use different PHP versions.
php -vonly shows the first, so also checkphp-fpm -vor a temporaryphpinfo()page that you delete again afterwards. - Ask your hosting provider. On shared hosting you cannot do this yourself. Ask for a confirmation in writing.
- Replace PHP 8.1 and older. These branches get no release from the PHP project. Source backports exist for 7.4, 8.0 and 8.1, and some vendors offer patched packages, but a supported version is the lasting answer.
If you cannot update today
The project lists interim measures and says plainly that they reduce exposure to specific attack paths but do not make an installation safe. Among them are session.upload_progress.enabled=0 set in php.ini or the pool configuration with all workers restarted, low request size limits, and on PHP 8.5 fatal_error_backtraces=0. A WAF rule can block known attack patterns, but it does not fix PHP. Check that your origin server cannot be reached directly past the WAF. If a site is not important, taking it offline until it is patched is a legitimate choice.
Patching does not remove an intruder
An update closes the hole, not the door someone may already have opened. Look at the period from before the announcement onwards:
- unusual requests and unexplained crashes of PHP workers
- PHP processes starting commands they normally never start
- new or changed files in the web root, and new admin accounts
- unexpected outbound connections from the web server
Application logs may show little, because the attack happens below the application. The flaws can also expose memory from other requests, and with it passwords, tokens and API keys. If you find signs of an attack, preserve the evidence first, then rotate the credentials the server had access to.
Update, 23 October 2026: PHP has announced a further flaw, CVE-2026-115560. It only affects applications that switch session.serialize_handler to php at runtime, and the fix follows in the next regular release. Until then PHP suggests keeping session.upload_progress.enabled=0.
Not sure what is exposed on your side? Pentesting and consulting →