PHP2Shell: CVE-2026-109618 and CVE-2026-109619

PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 to fix these two flaws. PHP says updating is the only complete fix.

Reviewed 30 Oct 2026 · Written by Rising from the linked sources. This is a dated snapshot, so check the official records before acting.

What the flaws are

CVE-2026-109618 is in how PHP handles running out of memory. PHP says the interruption can leave internal request data partly initialized, and request cleanup may then treat that data as valid.

CVE-2026-109619 is a use-after-free. Request-owned state can outlive the memory behind it, and a later request on the same worker may read that state before normal initialization resets it.

PHP labels both critical and scores each 9.2 on CVSS v4.0. Both can allow unauthenticated remote code execution. The name PHP2Shell comes from Wiz, according to Wikipedia.

Who is affected

PHP says the risk covers all installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php highest, because a demonstrated exploit there starts from an unauthenticated request before any application code runs.

The PHP Foundation reports code execution with default settings on mod_php for CVE-2026-109618, and says it was also confirmed on PHP-FPM through application-level code paths. PHP's advisory for that CVE says no complete FPM exploit has been demonstrated, so these two sources differ. For CVE-2026-109619, the Foundation says the reporter demonstrated code execution against a real-world application on mod_php.

What to do

Update to one of the four fixed releases, or to your distribution's package. PHP gave Linux distributions and long-term support vendors the patches in advance.

The PHP project no longer updates 8.1 and older. It published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source, and some vendors ship their own backported packages. Moving to a supported branch is the other route.

PHP's advisory lists temporary settings for each flaw, but says they reduce exposure to specific attack paths and do not make an installation safe.

Palo Alto Networks says PAN-OS management interfaces exposed to the internet are being exploited. It tells customers to remove public internet access to those interfaces and apply its PAN-OS fixes.

PHP added a separate notice on 23 October about CVE-2026-115560. It suggests setting session.upload_progress.enabled=0 until the next regular bugfix release, and says the issue needs an unusual mix of configuration and application code.

Exploitation so far

CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 26 October, with a 29 October deadline for US federal civilian agencies. Its catalog lists ransomware use as unknown. On 28 October CISA added a Linux kernel flaw, CVE-2026-46300, and said it can be chained with both PHP flaws to implant webshells and run commands as root.

Dream Research says it found a campaign that paired PHP2Shell with the Linux flaw and rooted 25 PAN-OS firewall and management servers across the United States, Japan, Taiwan and South Korea. Palo Alto Networks' Unit 42 says it independently verified the attacker's tooling and confirmed the results.

watchTowr also reports exploitation in the wild. Wiz said on 27 October that it had seen a limited number of attempts and no successful end-to-end exploitation in its own telemetry. Wiz points to a public report by Adel Karimi as the strongest public evidence at that time, and notes that those honeypots used a favourable single-worker mod_php setup.

Wiz also saw tools branded PHP2Shell that attempted neither flaw. They relied on session poisoning and a separate local file inclusion bug in the application. A PHP2Shell label on a tool does not confirm either CVE.

How it was found and disclosed

The PHP Foundation traces CVE-2026-109618 to 2024, when a core developer found the first signs of the memory problem while fixing an issue from a Quarkslab audit. No concrete attack path was known then. The security team struggled to choose a fix, and the Foundation says the delay came from the team's decision process and lack of resources.

Calif reported unconditional remote code execution with the same root cause on 11 August 2026, and OpenAI independently reported that root cause. Wiz sent further attack vectors on 24 August and OpenAI on 18 September.

The CVE IDs began circulating online around 15:00 UTC on 20 October, with a wrong release time and a wrong score of 10.0. According to Bitdefender, PHP published its pre-announcement early, at 19:30 UTC, and moved the release up a day, to 21 October at 14:00 UTC. Bitdefender also says Calif mistakenly published a video of its proof of concept at about 20:00 UTC. GitHub shows both advisories published at 13:34 UTC on 21 October.

Remediation so far

Wiz says the daily number of vulnerable internet-exposed machines it could see fell by about 67% over the days after disclosure. It reports that less than 53% of initially affected organizations were still vulnerable a week on. Wiz says this is consistent with patching, upgrades, retired machines and restricted access, but does not establish how much each contributed, and that scan coverage can move the numbers.

Settings