PHP2Shell: two critical PHP flaws. Patch today.
PHP released fixes on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619, two flaws in the language core rated CVSS 9.2 that each allow code execution from one unauthenticated request landing before any application code runs. The exposure is the server. Not a plugin. Not a theme.
PHP released fixes on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619, two flaws in the language core rated CVSS 9.2 that each allow code execution from one unauthenticated request landing before any application code runs. The exposure is the server. Not a plugin. Not a theme.
Who is exposed
Any site served by an unpatched PHP. Roughly 3 in 4 sites with a known server language. Exposed is not breached. PHP's team describes a demonstrated exploit. Cloudflare reports early attack attempts. No confirmed breach had been published when this was written.
What fails, and for whom
An attacker sends one request. The worker executes their code. Everything that worker can read, they can read. Sessions. Credentials in config. The database connection. For a WordPress shop that is the customer list and the payment plugin keys. For a public body it is whatever the site can reach.
Fix
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
On 7.4, 8.0 or 8.1: PHP published minimal source backports for people building from source or without a vendor. Those branches stay unsupported. Take your distribution's package where one exists. AlmaLinux has shipped for every stream on 8, 9 and 10.
On managed hosting: ask the provider which build is serving the site today. Get the version number.
Until patched
PHP's advisory: "there are no complete mitigations, updating is the only safe choice." The partial measures, per CVE: memory_limit set to -1 where applications cannot override it. A low post_max_size. Request limits at the proxy. Container limits. session.upload_progress.enabled off, with every worker restarted. On 8.5, fatal_error_backtraces off. The UK NCSC's guidance is shorter. Update now, or take the system offline.
The fact underneath
Calif, Wiz and OpenAI researchers found the flaws. Wiz says frontier models turned a longstanding bug into an exploit. Bug to exploit is now hours. Fix to production has to match. Can you name the PHP build serving you right now? That is the whole test.
Sources
https://www.php.net/archive/2026.php
https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/