PHP2Shell: Emergency PHP Patches Close Two Unauthenticated RCE Flaws

PHP shipped emergency patches on Wednesday, October 21, at 14:00 UTC, which is 10:00 a.m. Eastern, to fix a PHP2Shell vulnerability: two flaws that let attackers run code on web servers without logging in. The bugs, CVE-2026-109618 and CVE-2026-109619, reach back to PHP 5.4.0, released in 2012, and attack traffic appeared before the fix did.

Any US business that runs PHP on a web server needs to act today. CISA issued an urgent notice the same day, but neither flaw had been added to its Known Exploited Vulnerabilities catalog at the time of writing, so the exploitation picture is still forming.

How the PHP2Shell disclosure unfolded

The warning came a day early. PHP's security team posted an advance notice on October 20 that a critical release was coming, and said it would ship sooner if details became public or exploitation appeared. Both things happened. CVE identifiers began circulating online on October 20 at about 15:00 UTC, attached to a wrong release time and a wrong CVSS score of 10.0. PHP moved the release up from October 22 to October 21.

In its advisory, the team wrote: “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” BleepingComputer quoted that line in its coverage of the patches.

According to The Hacker News and BleepingComputer, researchers at Calif, OpenAI and Wiz found the flaws. The PHP Foundation said a core developer first spotted signs of the out-of-memory flaw while fixing an issue raised by a 2024 external audit.

Which servers are exposed to the PHP2Shell vulnerability

Nearly every PHP version back to 5.4 is affected. The two bugs work differently but share a result: code execution with the privileges of the web worker process. CVE-2026-109618 involves out-of-memory corruption, and CVE-2026-109619 involves stale global state. Both are rated 9.2 on CVSS v4.0 in the official scoring.

The score is not settled everywhere. A leaked report and the research firm watchTowr cite 10.0, and that discrepancy is unresolved. For administrators, the practical answer is the same either way.

PHP's own analysis ranks Apache mod_php as the highest-risk setup. A single unauthenticated request can trigger the bug before any application code runs, so a well-written plugin or custom app does not shield the server. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed also appear on the affected list. One flaw is susceptible under FPM, but no complete FPM exploit has been publicly demonstrated.

PHP sits behind WordPress, Magento and Drupal, so the exposure reaches a large share of the public web. Cyber Kendra lists US web hosts, small-business and e-commerce sites on WordPress or other PHP apps, Linux server administrators and cloud deployments such as AWS Lambda PHP images as in scope.

Which PHP versions get the fix

Support status is the real dividing line. The fixed releases are listed below, and every branch from 8.2 upward receives a patch. Older branches get none.

CISA said that any organization that cannot update, or still runs PHP 8.1 or older, should take PHP-based systems offline until they can be fixed. That is a hard choice for small shops, but it is the agency's stated position. A Phoenix Security blog estimates roughly 884,000 end-of-life hosts will stay beyond any fix. That figure comes from a single vendor blog and has not been independently confirmed.

Early attacks and what is still unknown

The exploitation picture is murkier than the patch picture. Sansec expected mass exploitation to follow the patch and public writeups. Cloudflare said it saw early attack traffic at 07:43 UTC on October 21, before the release, and had already deployed web application firewall rules.

Other reports are less certain. Patchstack claims active exploitation but has not published evidence. The Dutch NCSC reported no abuse, and no successful break-in has been publicly confirmed.

The disruption was visible, too. NBC News reported that several websites were briefly down on Wednesday morning while operators worried about takeover, and named Pinboard and parts of Wikipedia among them. Public exploit code is also spreading. One tracker counted more than 100 PHP2Shell repositories on GitHub after disclosure, and Tenable warned that unverified exploit code may carry malware.

Wiz said frontier AI models substantially reduced the barrier to turning this flaw into a working exploit. Security researcher Kevin Beaumont was blunter, saying, “The PHP situation will lead to a mass of incidents – it's one of the biggest vulns in years.” Similar speed has shown up elsewhere. USA 24 reported that Plex2Shell exploits hit unpatched Plex servers within a day of disclosure.

Steps to take on your PHP servers today

• Check the PHP version on every server, including staging machines and cPanel-managed hosting. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
• If you cannot patch right away, remember that PHP says updating is the only complete fix. Hosting-level mitigations exist but are partial.
• Ask your host what it has deployed. InMotion Hosting has published status updates, and rollout is still changing through the day.
• For WordPress, confirm the PHP runtime is updated. WordPress.org says no WordPress release is needed because the flaws sit in PHP itself, and Codeable notes that core and plugin updates alone do not fix this.
• Review logs on any server that was exposed and unpatched during the window, since compromise is not yet ruled out.
• Check cloud images, including AWS Lambda PHP images, and rebuild them on patched runtimes.
• Verify any proof-of-concept code before running it.

What to watch next

Three signals will show how serious this becomes. The first is a listing in CISA's Known Exploited Vulnerabilities catalog, which would confirm exploitation in the wild and start federal patch deadlines. The second is a public, complete FPM exploit, which would widen the set of exposed setups beyond mod_php.

The third is the scoring dispute. If the severity moves from 9.2 to 10.0, scanners and compliance teams will likely reprioritize their queues. Hosts will keep rolling out fixes through the day, and the hardest cases will be forgotten PHP 8.1 installs that never receive a patch at all.