PHP2Shell: The Critical PHP RCE Vulnerability (CVE-2026-109618, CVE-2026-109619) and How to Fix It

PHP2Shell is the name given to two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, that allow an unauthenticated attacker to execute code on a web server while PHP is still parsing the request. These vulnerabilities have a CVSS v4.0 severity score of 9.2 and both were patched on October 21, 2026. The only way to fully fix these issues is to update PHP.

The vulnerabilities are located within the PHP engine, not in WordPress, plugins, or custom code. Updating the CMS will not resolve the issues. Fixed versions include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, released on the same day. Restart PHP-FPM or Apache after upgrading. Every web-serving setup is affected, including PHP-FPM, Apache mod_php (highest risk), php-cgi, FrankenPHP, and LiteSpeed, running versions starting from PHP 5.4.

PHP 8.1 and older versions do not have an official patch available. The Center for Internet Security (CISA) advises taking unpatched systems offline to mitigate the risk. Two separate memory safety bugs are responsible for the vulnerabilities. CVE-2026-109618 occurs when PHP runs out of memory during a request, and the emergency bailout mechanism can corrupt internal request data.

An attacker can then inject invalid data and force execution of their own code. CVE-2026-109619 is a use-after-free issue, where internal state remains after the memory has been freed. This leads to remote code execution without authentication. Both bugs occur during request parsing and handling, before any application code starts running.

PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed are all susceptible. The vulnerabilities have been known since PHP 5.4 was released in 2012, and OX Security estimates that roughly two million PHP servers on the public internet are vulnerable. Several government websites were taken offline as a precaution while they were patched.

Exploitation attempts were logged before the patches were released, indicating that the vulnerabilities were being actively exploited. As of October 22, 2026, no confirmed compromises of specific organizations had been reported, but CISA recommends immediate patching or taking unpatched PHP systems offline until they can be updated.

To check the PHP version running on your site, use the command "php -v" in the command line. However, note that the command-line PHP might be a different build or version than the one serving your website. Confirm the web server's PHP version by creating a temporary "phpinfo.php" file, displaying the version at the top of the page, and then deleting the file.

Make sure to compare the full package version against your vendor's security advisory if you use a distribution or host that backports security fixes without changing the version number. The fix for PHP2Shell is to update to the fixed release for your PHP branch or any newer release within that branch. After updating, restart the workers, as the old PHP processes will continue to run the vulnerable code until they are replaced.