PHP2Shell: Patch CVE-2026-109618 and CVE-2026-109619 in PHP

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed by the PHP project on October 21, 2026. These issues could allow unauthenticated remote code execution on affected systems. The PHP advisory announced fixed releases to address these vulnerabilities, which apply to all PHP runtimes, not just specific frameworks or CMS platforms like WordPress or Laravel. Regardless of the accompanying software, the PHP interpreter itself contains the flaw.

The vulnerabilities manifest in two ways: an out-of-memory condition interrupting request processing with partially initialized data, and stale request state lingering in memory after it should have been freed. These technical details are presented in a simplified manner in the advisory, but developers should consult the official PHP advisory for in-depth information.

Upgrading to the appropriate fixed release or a later security release for the specific PHP branch is the recommended course of action. Support from operating-system or hosting vendors may be necessary, as they may have backported fixes to older branches. Unsupported branches should be migrated to supported ones, and internet-facing applications should be isolated until remediation is complete, based on a risk assessment and vendor guidance.

It's crucial to understand that a runtime patch is separate from an application update. Modifications to the PHP binary, such as upgrading Composer-managed dependencies or upgrading Laravel or WordPress, do not automatically update the PHP interpreter itself. Each PHP runtime must be individually verified and patched through the proper channels, whether that's a self-managed host or managed hosting environment.