{
  "id": 16093645,
  "title": "PHP2Shell: Patch CVE-2026-109618 and CVE-2026-109619 in PHP",
  "url": "https://urgent.news/2026/10/22/php2shell-patch-cve-2026-109618-and-cve-2026-109619-in-php",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-22T19:21:39.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/webmixstudio/php2shell-patch-cve-2026-109618-and-cve-2026-109619-in-php-514p"
  },
  "original_language": "en",
  "account": "Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed by the PHP project on October 21, 2026. These issues could allow unauthenticated remote code execution on affected systems. The PHP advisory announced fixed releases to address these vulnerabilities, which apply to all PHP runtimes, not just specific frameworks or CMS platforms like WordPress or Laravel. Regardless of the accompanying software, the PHP interpreter itself contains the flaw.\n\nThe vulnerabilities manifest in two ways: an out-of-memory condition interrupting request processing with partially initialized data, and stale request state lingering in memory after it should have been freed. These technical details are presented in a simplified manner in the advisory, but developers should consult the official PHP advisory for in-depth information.\n\nUpgrading to the appropriate fixed release or a later security release for the specific PHP branch is the recommended course of action. Support from operating-system or hosting vendors may be necessary, as they may have backported fixes to older branches. Unsupported branches should be migrated to supported ones, and internet-facing applications should be isolated until remediation is complete, based on a risk assessment and vendor guidance.\n\nIt's crucial to understand that a runtime patch is separate from an application update. Modifications to the PHP binary, such as upgrading Composer-managed dependencies or upgrading Laravel or WordPress, do not automatically update the PHP interpreter itself. Each PHP runtime must be individually verified and patched through the proper channels, whether that's a self-managed host or managed hosting environment.",
  "summary": "A developer-focused guide to fixed releases, runtime verification, WordPress and Laravel deployments, containers, workers, and post-patch checks. Action required: PHP announced security releases on October 21, 2026, fixing two critical vulnerabilities that can allow unauthenticated remote code execution on affected systems. Inventory your PHP runtimes, patch the runtime that serves requests,…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}