PHP ships emergency patches for critical "php2shell" flaws enabling remote code execution
What's the deal? The PHPDealroom has a profile for this one. Try Dealroom → project released emergency updates — versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — on October 21, 2026, to fix two critical vulnerabilities that let an unauthenticated attacker run code on servers running PHP. Tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed "php2shell," both are rated CVSS 9.2 by the vendor. The PHP Foundation urges immediate patching, calling it the only complete fix.
What's affected? Every PHP install that serves web requests — including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeedDealroom has a profile for this one. Try Dealroom →. The risk is highest on Apache with mod_php, where an unauthenticated request can trigger the flaw before any application code runs. Both bugs sit in parts of PHP that nearly every request touches: memory management and error handling.
Why now? Amazon reported an exploitation attempt four days before disclosure, and security vendors saw attack traffic around the public release, with details leaking ahead of the planned announcement. The Canadian Centre for Cyber Security says a proof of concept is available, though it has not yet confirmed active exploitation.
How it was found: The first signs of the out-of-memory flaw behind CVE-2026-109618 surfaced in 2024, during PHP's first external security audit in years, funded through the Sovereign Tech Agency and carried out by Quarkslab. Work on a fix stalled for months as a small team weighed trade-offs between backward compatibility, performance, and changes to third-party extensions. The Foundation called the delay "a structural failure."
What could go wrong? Because the bugs are in the PHP runtime, application-level authentication or updating a site's code does not address the exposure. US$0.16 and older branches no longer receive official fixes, so users on unsupported versions must rely on vendor backports or upgrade. Third-party appliances and SaaS products that bundle PHP are also exposed.
The signal: PHP still underpins a large share of the web, so a runtime-level flaw is an ecosystem-wide event, not a single-vendor patch. National agencies including CISA, CERT-EU, ENISA, and NCSC-NL issued advisories, underscoring the breadth of the exposure. The episode also highlights how a non-profit with a small core team shoulders the security of critical open-source infrastructure.
Read more: thephp.foundation
Image credit: El Taller del Bit
