# PHP2Shell: Emergency PHP Patches Close Two Unauthenticated RCE Flaws

- URL: https://usa-24.com/php2shell-vulnerability-patch/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-22T05:37:10.483Z
- Updated: 2026-10-22T05:37:10.490Z
- Topics: PHP2Shell, Vulnerability Patches, Remote Code Execution, Web Server Security, CISA

> Emergency PHP patches released October 21 close two unauthenticated code execution flaws that reach back to PHP 5.4. Here is which versions to update and what to check first.

## Key takeaways

- PHP released emergency patches at 14:00 UTC on October 21, 2026, fixing CVE-2026-109618 and CVE-2026-109619.
- Both flaws allow unauthenticated remote code execution and affect nearly every PHP version back to 5.4.0, released in 2012.
- The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while PHP 8.1 and older receive no fix.
- Apache mod_php is the highest-risk setup because a single request can trigger the attack before any application code runs.
- No successful break-in has been publicly confirmed, but Cloudflare reported attack traffic that appeared before the release.

PHP shipped emergency patches on Wednesday, October 21, at 14:00 UTC, which is 10:00 a.m. Eastern, to fix a PHP2Shell vulnerability: two flaws that let attackers run code on web servers without logging in. The bugs, CVE-2026-109618 and CVE-2026-109619, reach back to PHP 5.4.0, released in 2012, and attack traffic appeared before the fix did.

Any US business that runs PHP on a web server needs to act today. CISA issued an urgent notice the same day, but neither flaw had been added to its Known Exploited Vulnerabilities catalog at the time of writing, so the exploitation picture is still forming.

## How the PHP2Shell disclosure unfolded

The warning came a day early. PHP's security team posted an advance notice on October 20 that a critical release was coming, and said it would ship sooner if details became public or exploitation appeared. Both things happened. CVE identifiers began circulating online on October 20 at about 15:00 UTC, attached to a wrong release time and a wrong CVSS score of 10.0. PHP moved the release up from October 22 to October 21.

In its advisory, the team wrote: “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” [BleepingComputer](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/) quoted that line in its coverage of the patches.

According to [The Hacker News](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html) and BleepingComputer, researchers at Calif, OpenAI and Wiz found the flaws. The [PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) said a core developer first spotted signs of the out-of-memory flaw while fixing an issue raised by a 2024 external audit.

## Which servers are exposed to the PHP2Shell vulnerability

Nearly every PHP version back to 5.4 is affected. The two bugs work differently but share a result: code execution with the privileges of the web worker process. CVE-2026-109618 involves out-of-memory corruption, and CVE-2026-109619 involves stale global state. Both are rated 9.2 on CVSS v4.0 in the official scoring.

The score is not settled everywhere. A leaked report and the research firm watchTowr cite 10.0, and that discrepancy is unresolved. For administrators, the practical answer is the same either way.

PHP's own analysis ranks Apache mod_php as the highest-risk setup. A single unauthenticated request can trigger the bug before any application code runs, so a well-written plugin or custom app does not shield the server. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed also appear on the affected list. One flaw is susceptible under FPM, but no complete FPM exploit has been publicly demonstrated.

PHP sits behind WordPress, Magento and Drupal, so the exposure reaches a large share of the public web. [Cyber Kendra](https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html) lists US web hosts, small-business and e-commerce sites on WordPress or other PHP apps, Linux server administrators and cloud deployments such as AWS Lambda PHP images as in scope.

## Which PHP versions get the fix

Support status is the real dividing line. The fixed releases are listed below, and every branch from 8.2 upward receives a patch. Older branches get none.

| Branch | Fixed release | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Patch now |
| PHP 8.4 | 8.4.27 | Patch now |
| PHP 8.3 | 8.3.36 | Patch now |
| PHP 8.2 | 8.2.35 | Patch now |
| PHP 8.1 and older | None | End of life, take PHP systems offline until fixed |

CISA said that any organization that cannot update, or still runs PHP 8.1 or older, should take PHP-based systems offline until they can be fixed. That is a hard choice for small shops, but it is the agency's stated position. A [Phoenix Security](https://phoenix.security/php-core-rce-cve-2026-109618-109619-critical-remote-code-execution/) blog estimates roughly 884,000 end-of-life hosts will stay beyond any fix. That figure comes from a single vendor blog and has not been independently confirmed.

## Early attacks and what is still unknown

The exploitation picture is murkier than the patch picture. [Sansec](https://sansec.io/research/php2shell) expected mass exploitation to follow the patch and public writeups. Cloudflare said it saw early attack traffic at 07:43 UTC on October 21, before the release, and had already deployed web application firewall rules.

Other reports are less certain. Patchstack claims active exploitation but has not published evidence. The Dutch NCSC reported no abuse, and no successful break-in has been publicly confirmed.

The disruption was visible, too. [NBC News](https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-update-systems-rcna604751) reported that several websites were briefly down on Wednesday morning while operators worried about takeover, and named Pinboard and parts of Wikipedia among them. Public exploit code is also spreading. One tracker counted more than 100 PHP2Shell repositories on GitHub after disclosure, and Tenable warned that unverified exploit code may carry malware.

Wiz said frontier AI models substantially reduced the barrier to turning this flaw into a working exploit. Security researcher Kevin Beaumont was blunter, saying, “The PHP situation will lead to a mass of incidents – it's one of the biggest vulns in years.” Similar speed has shown up elsewhere. USA 24 reported that [Plex2Shell exploits hit unpatched Plex servers within a day](https://usa-24.com/plex2shell-plex-media-server-update/) of disclosure.

## Steps to take on your PHP servers today

- Check the PHP version on every server, including staging machines and cPanel-managed hosting. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- If you cannot patch right away, remember that PHP says updating is the only complete fix. Hosting-level mitigations exist but are partial.
- Ask your host what it has deployed. [InMotion Hosting](https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/) has published status updates, and rollout is still changing through the day.
- For WordPress, confirm the PHP runtime is updated. WordPress.org says no WordPress release is needed because the flaws sit in PHP itself, and [Codeable](https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/) notes that core and plugin updates alone do not fix this.
- Review logs on any server that was exposed and unpatched during the window, since compromise is not yet ruled out.
- Check cloud images, including AWS Lambda PHP images, and rebuild them on patched runtimes.
- Verify any proof-of-concept code before running it.

## What to watch next

Three signals will show how serious this becomes. The first is a listing in CISA's Known Exploited Vulnerabilities catalog, which would confirm exploitation in the wild and start federal patch deadlines. The second is a public, complete FPM exploit, which would widen the set of exposed setups beyond mod_php.

The third is the scoring dispute. If the severity moves from 9.2 to 10.0, scanners and compliance teams will likely reprioritize their queues. Hosts will keep rolling out fixes through the day, and the hardest cases will be forgotten PHP 8.1 installs that never receive a patch at all.

## Frequently asked questions

### Which PHP versions are affected by the PHP2Shell vulnerability?

Nearly every PHP version back to 5.4.0, released in 2012, is affected by CVE-2026-109618 and CVE-2026-109619. Apache mod_php is rated the highest-risk setup because one unauthenticated request can trigger the attack. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also listed as affected.

### What is the PHP 8.2.35 update and how do I install it?

PHP 8.2.35 is one of four fixed releases, alongside 8.5.12, 8.4.27 and 8.3.36. Check your current PHP version on each server, then update through your host, package manager or control panel. PHP says updating is the only complete fix, and hosting-level mitigations are partial.

### Is my WordPress site vulnerable to PHP2Shell?

If your site runs on any PHP version earlier than the fixed releases, it is exposed. WordPress.org says no WordPress update is needed because the flaws sit in PHP itself. Check your PHP version in your hosting control panel and ask your host to confirm the runtime is patched.

### Has PHP2Shell been used in attacks yet?

Cloudflare reported early attack traffic at 07:43 UTC on October 21, before the release. Patchstack claims active exploitation but has not published evidence, and no successful break-in has been publicly confirmed. Neither flaw was in CISA's Known Exploited Vulnerabilities catalog at the time of writing.

## Sources

1. [PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge — The Hacker News](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html)
2. [Critical Vulnerabilities in PHP Require Immediate Patching — CISA](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching)
3. [Today's PHP Security Release, and How We're Strengthening PHP Security — The PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/)
4. [PHP ships emergency patches for critical PHP2Shell flaws — BleepingComputer](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/)
5. [PHP2Shell: Critical PHP vulnerabilities patched, update now! — Help Net Security](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/)
6. [PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws — SecurityWeek](https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/)
7. [PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) — Sansec](https://sansec.io/research/php2shell)
8. [Critical vulnerabilities in commonly used web code spark rush to update systems — NBC News](https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-update-systems-rcna604751)
9. [PHP2Shell: Critical PHP Flaws Allow Remote Code Execution — Cyber Kendra](https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html)
10. [PHP Security Release on 21 October 2026: What WordPress Site Owners Need to Do — Codeable](https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/)
11. [PHP Security Release: Critical Patch Out October 21 — InMotion Hosting](https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/)
12. [800 Systems affected PHP Core RCE (CVE-2026-109618, CVE-2026-109619) — Phoenix Security](https://phoenix.security/php-core-rce-cve-2026-109618-109619-critical-remote-code-execution/)