If a server you own or rent runs PHP and answers web requests, PHP2Shell is your patch of the week. On Oct. 21 at 14:00 UTC (10 a.m. ET), the PHP project released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, that it says “can allow unauthenticated remote code execution.” That means an attacker may be able to run commands on the server without a password. The PHP team’s advice is unusually short: “There are no complete mitigations, updating is the only safe choice.”
Where it stands: Security firms reported attack attempts around the time of the release, but exploitation has not been confirmed by CISA. When Data Breach Radar re-checked CISA’s Known Exploited Vulnerabilities feed late on Oct. 21 ET, it was still catalog version 2026.10.21, released at 14:04 UTC that day, and neither CVE was listed. A listing could come at any time.
What PHP2Shell is
PHP2Shell is the name for a pair of memory-handling bugs in the PHP runtime itself, not in any one app or plugin. NVD’s description of CVE-2026-109618 says PHP uses a shortcut to bail out of a request when it runs out of memory, and that “multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).” The second bug, CVE-2026-109619, involves leftover internal state: NVD says “PHP has various global state that temporarily points into request memory,” and that it too can be pushed into remote code execution.
PHP lists who is exposed: “all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.” It ranks mod_php as the worst case, saying a demonstrated exploit lets an unauthenticated request “trigger the attack before any application code runs.”
Wiz, which found the flaws with Calif and OpenAI, adds two points that matter for breach risk. It says “every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4,” and that the memory involved “may contain passwords, authentication tokens, API keys and certificates” from other requests or the server.
PHP2Shell fixed versions
| Branch you run | Fixed release | Branch status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Supported |
| PHP 8.4 | 8.4.27 | Supported |
| PHP 8.3 | 8.3.36 | Supported |
| PHP 8.2 | 8.2.35 | Supported until end of 2026 |
| PHP 8.1 and older | None from PHP | Vendor fixes or source backports only |
PHP says it gave Linux distributions and long-term-support vendors the patches early, so distro packages may already be available. For older branches, “PHP 8.1 and older no longer receive updates from the PHP project,” but its security team posted minimal source backports for 7.4, 8.0 and 8.1. PHP also reminds users that “PHP 8.2 reaches end of life on 31 December 2026,” after which that branch gets no more security fixes.
The scores, the leak, and the wrong 10.0
The CVE numbers went public a day early. Infosecurity Magazine reported that a forum post on Oct. 20, since deleted, revealed the identifiers before the patches were out. That post, the magazine said, claimed “two maximum-severity (CVSS rating of 10.0)” flaws to be disclosed on Oct. 22. Both details were wrong. PHP had already scheduled the release for Wednesday, Oct. 21, at 14:00 UTC, and rates both flaws lower than 10.0.
| Measure | What it says |
|---|---|
| PHP’s rating (CVSS v4.0) | 9.2, critical, for both |
| NVD’s own score (CVSS 3.1) | 9.8, critical, for both |
| Leaked forum claim | 10.0 (incorrect) |
| CISA KEV catalog | Not listed as of version 2026.10.21 |
| CISA’s SSVC note on NVD | Exploitation “none” at 14:34 UTC, Oct. 21 |
NVD published both records at 14:17 UTC on Oct. 21 (10:17 a.m. ET). The CISA assessment attached to each record, logged minutes later, recorded no known exploitation at that point. That entry is a snapshot, not a live status.
Attacks reported, exploitation not confirmed
Several security companies saw activity early. BleepingComputer reported that, before the patches shipped, Cloudflare’s chief technology officer Dane Knecht confirmed the company “was already observing early attacks targeting the two vulnerabilities.” Tenable relayed that watchTowr “is observing exploitation attempts against both.”
Other signals point the other way, for now. Tenable said code claiming to exploit the flaws is circulating, “but we have not verified that any of it works.” And the PHP Foundation said its security team reviewed proof-of-concept code that surfaced after the leak and “did not identify any functional exploits at the time of release/public disclosure.”
So the accurate description today is attack attempts reported, not confirmed exploitation in the wild. That gap is not a reason to wait. Security researcher Kevin Beaumont, quoted by Help Net Security, put it this way: “The PHP situation will lead to a mass of incidents – it’s one of the biggest vulns in years.” The UK’s National Cyber Security Centre has told organizations to update PHP systems immediately or take them offline until they can be patched, BleepingComputer reported.
Who needs to patch PHP2Shell, and how
Anyone running PHP for a website or API is in scope. That includes WordPress, Drupal, Magento and Laravel apps, because they all run on the PHP runtime. Here is how the job splits by setup:
- Your own servers with distro PHP: install your distribution’s updated package and restart PHP-FPM or the web server. Confirm the version your web server actually uses, which can differ from the command-line
php -voutput. - Laravel Forge: Forge warns that its “automatic security updates do not patch PHP.” Update each PHP version from the dashboard or over SSH. Forge says the update restarts PHP-FPM, and that patched packages “may not be available the moment PHP publishes the release,” so retry if the fix isn’t there yet.
- Shared or managed hosting: you usually can’t patch PHP yourself. Ask your host which build your sites run and when it moved to a fixed release.
- PHP 8.1 or older: check with your vendor for a backported fix, or move to a supported branch.
- Behind a web application firewall: Cloudflare has deployed rules for “the known exploit vectors,” per Help Net Security, and Google says its Cloud Armor managed rules are “available now.” Those reduce exposure; they are not the patch.
If you truly cannot update today, PHP’s advisory lists configuration changes for each CVE, but it is explicit that they “reduce exposure to specific attack paths but do not make an installation safe.” Follow that page exactly rather than a summary.
After patching: check for signs of compromise
Patching closes the hole; it does not undo anything that came through it. If a public-facing PHP server stayed unpatched after Oct. 21, review web and PHP-FPM logs for crashes or unusual requests, look for new files in web directories and unexpected scheduled jobs, and check outbound connections. Because Wiz says leaked memory can include tokens and API keys, rotate credentials stored on any server that shows signs of tampering. Our guide on checking whether application secrets were leaked walks through that review, and our October 2026 breach roundup tracks the month’s other incidents.
For context on the stakes, Tenable noted that “the CISA Known Exploited Vulnerabilities (KEV) catalog includes three vulnerabilities in PHP itself.” PHP2Shell is not yet on that list.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name researchers gave to two critical flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619. PHP says they can allow unauthenticated remote code execution on installations that serve web requests. Each supported branch, from 8.2 to 8.5, received a fixed release on October 21.
Has PHP2Shell been exploited in the wild?
So far, reports describe attempts. Cloudflare said it was seeing early attacks and watchTowr reported exploitation attempts, but Tenable said it had not verified public exploit code, and the vulnerabilities were not in CISA’s Known Exploited Vulnerabilities catalog when we checked late on October 21.
Is PHP2Shell a 10.0 vulnerability?
No. A leaked forum post claimed 10.0, but PHP rates both flaws 9.2 under CVSS v4.0, and NVD’s own CVSS 3.1 score is 9.8. Both scores are critical.
Does PHP2Shell affect WordPress sites?
WordPress runs on PHP, so a WordPress site is exposed through whatever PHP version its server uses, not through WordPress itself. If you are on shared or managed hosting, ask your host whether your PHP version has been updated to a fixed release.
What if I am still on PHP 8.1 or older?
The PHP project no longer ships updates for 8.1 and older. Its security team published minimal source backports for 7.4, 8.0 and 8.1, and some Linux distributions and LTS vendors provide fixes. Moving to a supported branch is the longer-term fix.
Sources
- Security advisory: Critical remote code execution vulnerabilities, update now — PHP.net (PHP security team), October 20-21, 2026
- CVE-2026-109618 — NIST National Vulnerability Database (API record), October 21, 2026
- CVE-2026-109619 — NIST National Vulnerability Database (API record), October 21, 2026
- CISA Catalog of Known Exploited Vulnerabilities (JSON feed) — CISA, catalog version 2026.10.21 (re-checked October 21, 2026, evening ET)
- php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ — Tenable, October 21, 2026
- PHP ships emergency patches for critical PHP2Shell flaws — BleepingComputer (Sergiu Gatlan), October 21, 2026
- Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches — Infosecurity Magazine (Kevin Poireault), October 21, 2026
- PHP2Shell: Critical PHP vulnerabilities patched, update now! — Help Net Security (Mirko Zorz), October 21, 2026
- PHP security advisory (CVE-2026-109618, CVE-2026-109619) — Laravel Forge documentation, October 21, 2026
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet — Wiz Research, October 21, 2026
- Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 — Google Cloud Blog, October 21, 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.