Quick answer: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on servers running PHP. Both score 9.2 on CVSS v4.0. Update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or newer), restart PHP-FPM or your web server, and verify the version with php -v.

A serious PHP vulnerability is dominating security news this week. The flaws sit in the PHP core, so they can affect every website, WordPress blog, Laravel app and online store that runs on a vulnerable PHP version.

What happened?

Two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow remote code execution on servers running PHP without authentication. They were widely reported on October 21, 2026, and the security community nicknamed them PHP2Shell.

The disclosure was messy. On October 20, a user leaked the existence of both flaws ahead of the planned date. The PHP security team then moved its emergency release up to October 21 at 14:00 UTC.

Why this PHP vulnerability is so dangerous

• Severity: both flaws score 9.2 on the CVSS v4.0 scale.
• It is in PHP itself: updating a plugin, theme or CMS does not remove the flaw. You must update the PHP runtime.
• No login needed: an unauthenticated visitor can reach the vulnerable code.
• Wide exposure: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all at risk. mod_php is considered the highest risk.
• Fast exploitation expected: threat intelligence firms report heavy dark web discussion and rate the likelihood of exploitation as very high.

Technical overview in plain English

Both issues are use-after-free bugs (CWE-416). PHP keeps using a piece of memory after it has been released, which can let an attacker influence what the server runs.

CVE-2026-109618

Relates to how PHP handles out-of-memory conditions during request processing. Request structures can be left partially initialized, and the advisory describes multipart request scenarios that reach the vulnerable code.

CVE-2026-109619

A use-after-free in PHP's request state management, where request-owned data stays accessible after its memory is freed.

Successful exploitation gives an attacker code execution inside the PHP process.

Which PHP versions are affected?

Versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are vulnerable. There are no official fixes for older branches, and unofficial reports say releases as far back as 5.4.0 are also affected. If you run PHP 7.x or older, plan an upgrade to a supported release.

How to fix the PHP vulnerability

1. Update PHP to a fixed version. Patching is the only reliable fix.
2. Restart services. Restart PHP-FPM or your web server, then confirm the version with php -v.
3. Check distro packages. If PHP came from your operating system's packages, read the package changelog, because the version number may not change.
4. Check containers and appliances. Rebuild Docker images and look for third-party products that bundle PHP.
5. Review logs from October 20 onward for unusual multipart or upload requests.

Temporary mitigation if you cannot patch yet

Set session.upload_progress.enabled to off and restart PHP workers. This blocks one confirmed exploitation path tied to CVE-2026-109619. It reduces exposure but is not a complete fix.

Who should act immediately?

• Owners of VPS and dedicated servers
• WordPress, Drupal, Magento, Joomla and Laravel users
• Agencies managing client websites
• Companies running internal PHP tools
• Shared hosting customers: ask your host to confirm they have patched

Key takeaways

• Two critical PHP core flaws allow unauthenticated remote code execution.
• Both score 9.2 (CVSS v4.0).
• Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 now.
• Restart PHP processes and verify your version.
• Plugin or CMS updates alone will not fix this.

Sources: Kaspersky, Canadian Centre for Cyber Security (AL26-026), Bitsight, Field Effect, Pentest-Tools, Health-ISAC.