Learn about PHP2Shell, CVE-2026-109618 and CVE-2026-109619, including fixed PHP versions, WAF limitations and website security checks.

Last reviewed: 22 October 2026

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, require urgent attention from website owners, developers and hosting administrators. Commonly referred to as PHP2Shell, these vulnerabilities affect the PHP runtime behind web applications.

The PHP project released security updates on 21 October 2026 and urged users to update immediately. Both vulnerabilities have a CVSS v4.0 severity score of 9.2, according to the published advisories.

For businesses, the immediate priority is to confirm whether the PHP runtime serving each application has received the fix. Updating a CMS, theme or plugin alone does not resolve these runtime vulnerabilities.

What Are the PHP2Shell Vulnerabilities?

Both vulnerabilities involve unsafe handling of memory or internal request state when PHP processing is interrupted. Depending on the deployment and attack path, exploitation can lead to remote code execution or disclosure of worker memory.

CVE-2026-109618: Remote Code Execution Through Out-of-Memory Corruption

PHP uses an error-handling mechanism that can interrupt processing when memory allocation fails. In affected operations, this interruption can leave internal request memory partially initialized. During request cleanup, PHP may treat that invalid memory as usable state.

The PHP technical advisory describes multiple out-of-memory strategies that can lead to remote code execution.

CVE-2026-109619: Remote Code Execution Through Stale Global State

This vulnerability involves internal references that remain after the request memory they point to has been freed. A later request handled by the same PHP worker may access those outdated references before normal initialization resets them.

The advisory confirms memory disclosure and remote code execution with the web worker’s privileges. This should not automatically be interpreted as unrestricted administrator access to the server.

Which PHP Websites and Deployments Are at Risk?

The PHP project identifies installations serving web requests as at risk, including:

Apache with mod_php
PHP-FPM
php-cgi
FrankenPHP
LiteSpeed

PHP considers Apache mod_php the highest-risk deployment, citing a demonstrated exploit that can trigger before application code executes.

PHP-FPM also requires attention. PHP’s technical advisory describes validated session-lifecycle remote code execution against FPM under suitable application conditions. Using FPM does not establish that a deployment is safe.

Does PHP2Shell Affect WordPress, Drupal and Joomla?

Wiz Research reports demonstrated unauthenticated remote code execution against WordPress, Drupal and Joomla. The underlying vulnerabilities exist in the PHP engine rather than being confined to those content management systems.

This makes runtime maintenance essential. A website may have updated plugins while still running an unpatched PHP build.

These research demonstrations do not mean every website using these platforms has been compromised. The runtime, configuration, application behavior and vendor patch status need to be assessed.

Which PHP Versions Fix CVE-2026-109618 and CVE-2026-109619?

The PHP technical advisories list the following releases as containing fixes for both vulnerabilities:

PHP security releases addressing both PHP2Shell vulnerabilities
PHP Branch	Security Release Containing the Fixes
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

For distribution-managed installations, check the vendor’s advisory and fixed package release. Qualys notes that vendors may backport fixes while retaining an older upstream version number. A short PHP version string alone may therefore be insufficient to determine patch status.

What About PHP 8.1 and Older Versions?

PHP 8.1 and earlier are outside regular upstream updates. However, PHP’s current advisory provides limited source backports for PHP 7.4, 8.0 and 8.1, and notes that some distribution and long-term-support vendors provide backported fixes.

For older deployments, obtain confirmation of a fixed build or arrange an upgrade to a supported branch. Available source patches do not establish that a hosting provider has applied them to a particular website.

Are Attackers Targeting PHP2Shell?

Cloudflare reports observing attack traffic targeting these vulnerabilities, including payload changes intended to evade its protections. Unit 42 separately reports that it has seen proof-of-concept exploitation and recommends immediate assessment and patching.

These reports support an urgent response. They do not establish that a specific website has been breached.

Can a Web Application Firewall Protect Against PHP2Shell?

Cloudflare says it deployed PHP2Shell protections for customers using its free or paid web application firewall. Its guidance still recommends patching PHP, with the WAF providing an additional defensive layer.

Google Cloud also provides Cloud Armor mitigation guidance and advises customers to update and redeploy affected workloads. Customer-built container images need to be rebuilt with a patched PHP runtime and redeployed.

Verify WAF coverage and PHP patch status separately. A deployed firewall rule is not evidence that the underlying runtime has been updated.

How to Respond: A Practical PHP Security Checklist

The following operational checklist can help website owners coordinate remediation with developers and hosting providers.

1. Identify Every PHP Deployment

Create an inventory of PHP-backed websites, APIs, admin panels, staging systems and container images. Assign an owner to each deployment and record who manages its runtime.

Prioritize internet-facing applications and the higher-risk deployments identified by PHP.

2. Ask for Specific Patch Evidence

Request clear answers from the hosting or development team:

Which PHP runtime serves this application?
Which package or image release contains the fixes for both CVEs?
Has that release reached every serving instance?
What evidence confirms the deployed runtime is patched?

Record the answers for each application. A general statement that the server has been updated is less useful than confirmation tied to a specific deployment.

3. Apply the Fix and Validate the Application

Deploy the appropriate upstream security release or vendor-fixed package. For container deployments, verify that the running workload uses the updated image.

As a deployment acceptance check, test relevant user journeys such as login, enquiry forms, uploads and checkout. Record the deployed package or image identifier alongside the validation result.

4. Review Suspicious Behavior

Wiz recommends investigating unusual multipart requests associated with memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID response cookies, and unexplained PHP worker churn.

These signals are investigation leads rather than standalone proof of compromise. PHP also cautions that the absence of relevant log messages does not prove safety.

If an investigation identifies compromise, coordinate incident response alongside patching.

5. Document Completion

Maintain a completion record containing the application name, fix applied, deployment time, serving-runtime verification and application validation outcome.

This provides a practical basis for closing remediation work and identifying outstanding deployments.

What If You Cannot Update PHP Immediately?

PHP publishes temporary configuration measures that reduce exposure to specific attack paths. Its advisory explicitly states that these measures do not make an installation safe.

Have the administrator evaluate the current official guidance against the actual deployment. Assign an owner and deadline for the complete update, and track temporary measures until remediation is finished.

Make Runtime Security Part of Website Maintenance

PHP2Shell highlights a maintenance question every business should be able to answer: who owns the software runtime behind each website, and how is a security update verified in production?

Keep an application inventory, assign patch ownership and maintain a supported-runtime upgrade plan. These practices make urgent security work easier to coordinate and verify.

Need help confirming your website’s PHP patch status? Request a focused review of the serving runtime, vendor advisory, deployment evidence and outstanding remediation work.

Sources and Official Security Advisories

This article summarizes public advisories reviewed on 22 October 2026. It does not claim independent exploit testing or an assessment of any particular website. Recheck the advisories for updates when planning remediation.