Overview
- PHP released emergency updates on Wednesday, Oct. 21 that patch two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 with fixed builds 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Researchers say the flaws, dubbed php2shell, allow unauthenticated remote code execution by exploiting out-of-memory corruption and stale global state in request handling.
- Details leaked before the scheduled disclosure and security firms reported early exploit attempts, prompting Cloudflare and others to deploy temporary WAF rules while urging immediate upgrades.
- The official fixes cover only PHP 8.2 through 8.5 and PHP provided limited source backports for some older lines, leaving many end-of-life installations to seek vendor backports, rebuilds, or isolation.
- Authorities and vendors advise teams to inventory every PHP instance, prioritize internet-facing systems for rapid patching, inspect logs for web shells or suspicious activity, and take unreachable systems offline until they can be secured.