PHP has released security updates to address two critical remote code execution vulnerabilities, dubbed “PHP2Shell”, that could allow unauthenticated attackers to execute code on affected servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS severity score of 9.2 out of 10. The PHP project has urged users to update immediately, with fixes available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
How the flaws enable remote code execution
CVE-2026-109618 affects PHP’s handling of out-of-memory conditions. If an error interrupts request processing while internal data is only partially initialized, cleanup can mishandle that data and corrupt memory.
CVE-2026-109619 involves stale internal state that can persist after memory has been freed. A later request handled by the same worker may then use that stale state. Both flaws can enable unauthenticated remote code execution, although exploit paths vary by server configuration and PHP version. Wiz also reported that the vulnerabilities could expose sensitive data, including passwords, tokens, and API keys, from process memory.
PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, urging users to update immediately. PHP 8.1 and older are no longer directly updated by the PHP project, though some distributions and long-term-support vendors may provide backported fixes.
The Akido team also released a website to help users check whether they are affected by the PHP2Shell vulnerabilities.
Vulnerabilities traced back to earlier research
In a timeline published by Calif researcher Ryan Austin, earlier research into PHP’s memory handling dates back to 2020, when a bug report described an out-of-memory issue that could prevent temporary files from being cleaned up. A 2024 security audit by Quarkslab, organized through the Open Source Technology Improvement Fund (OSTIF), later uncovered a related issue, although a concrete exploit had not been established.
In July 2026, Calif began auditing PHP through the Patch the Planet initiative. Austin reported the first bug to PHP on August 11 and shared a proof of concept three days later. PHP confirmed it worked on August 15. They reported the second bug on August 21, while Wiz separately reported its findings to PHP on August 24.
Details leaked before coordinated disclosure
The PHP Foundation said the CVE identifiers appeared online on October 20, alongside an incorrect release date and a CVSS score of 10.0. The actual severity score was 9.2. PHP moved its pre-announcement to later that day and brought the release forward from October 22 to October 21.
Later on October 20, Calif accidentally published a proof-of-concept video showing the exploit working against targets. Although the video was removed, copies circulated online. On October 21, Chainguard published fixed container images more than six hours before PHP’s scheduled release. The PHP Foundation said, “This disregarded weeks of work by many parties toward a coordinated disclosure.” Sarah Gooding at Socket also covered more about it.
Web hosts roll out PHP2Shell patches and mitigations
Automattic said sites hosted on WordPress.com, WordPress VIP, WP Cloud, Pressable, and Tumblr are protected against the PHP2Shell vulnerabilities following coordination with the PHP Security team. Customers using these platforms do not need to take action. Those managing their own PHP installations should update to a fixed release.
InstaWP said it installed patched PHP versions across its managed servers and had applied an interim mitigation earlier that day. A small number of sites on older servers are being migrated to upgraded servers, with the mitigation remaining in place in the meantime. InstaWP customers do not need to take action on sites running PHP 8.2 or newer, while those on PHP 8.1 or older are advised to move to PHP 8.3 or newer after testing on a staging site.
Rocket.net, Liquid Web, and Bluehost reported that they were deploying security patches to across their hosting infrastructure. Rocket.net said patches were being rolled out in stages while its team monitored system stability, while Liquid Web was working to deploy patched PHP builds across cPanel, Plesk, and Windows Plesk environments. Bluehost said it had patched the majority of its servers and was completing updates on the remaining systems, with mitigations in place during the rollout.
GoDaddy had patched all PHP versions on its Windows Hosting and Managed Hosting for WordPress platforms, with no action required from customers on those services. The company was deploying vendor-supplied patches across all Web Hosting servers.
Kinsta reported that it was rolling out PHP security fixes across all versions from 7.4 through 8.5. It will continue using Cloudflare firewall rules and additional server-side protections on all sites until the patch rollout is complete and further notice is issued.
WP Engine confirmed that patches for both critical vulnerabilities had been deployed across its platform.
SiteGround said it had deployed server-level mitigation rules across all its servers before PHP’s official security release, disabling the affected functionality across supported PHP versions. The company said sites hosted on its platform were protected automatically and customers did not need to update PHP or change their settings.
Patchstack said hosting partners had reported multiple active exploitation incidents before PHP released its security updates, and Sucuri also reported exploitation attempts. Cloudflare also observed attack traffic targeting its customers, with attackers modifying their payloads in attempts to bypass its protections.
In response, Cloudflare deployed web application firewall (WAF) rules to block known exploit methods, making the protections available automatically to customers on free and paid plans. Sucuri also strengthened its existing firewall protections by adding rules targeting known exploitation methods.
Dane Knecht (CTO at Cloudflare) wrote, “ We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. “
Wordfence temporarily took its website offline while preparing to deploy the patch for the PHP2Shell vulnerabilities.
The Prime Minister of Japan also posted on X about the seriousness and to apply the patch immediately.
If you are running an older version of PHP, update to the patched version immediately. If you are managing your own WordPress website, you can check your PHP version from Tools > Site Health > Info > Server, or from your hosting control panel.