The PHP project and The PHP Foundation released emergency software updates on Wednesday, October 21, 2026, to patch two critical vulnerabilities in the core programming language runtime. Identified as CVE-2026-109618 and CVE-2026-109619—and collectively dubbed php2shell by cybersecurity specialists—both flaws allow unauthenticated remote code execution (RCE), enabling an outside attacker to run arbitrary commands on a target server without prior login credentials. The maintainers moved up the release schedule after technical details and proof-of-concept exploit videos leaked online ahead of the official coordination embargo, while threat monitoring teams confirmed active exploitation attempts in the wild.
Each vulnerability carries a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS) v4.0 standard, an international framework used to measure the severity of software security flaws. The fixed packages—versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35—went live at 14:00 UTC (10:00 a.m. EDT and 11:00 a.m. Brasília time) on Wednesday (21). According to telemetry from Palo Alto Networks Cortex Xpanse, more than 22.6 million internet-exposed instances worldwide were potentially vulnerable to the flaws at the time the patches were issued.
In an urgent advisory posted to the official ANNOUNCE mailing list on Tuesday (20) at 19:33 UTC, the PHP security team had warned system administrators to prepare for immediate deployment. “We reserve the right to release earlier if details of either vulnerability become public, or if evidence of active exploitation emerges,” the PHP security team stated in the pre-release notice.
Embargo breakdown and how the php2shell exploit chain leaked online
The coordinated disclosure process broke down on Tuesday (20), when a user operating under the handle petecooper posted a message—which was later deleted—on the Hacker News forum, sparking widespread discussion across social media networks. Shortly afterward, security researcher Kirill Firsov shared a video demonstrating the full exploitation chain named php2shell, attributing discovery credits to a researcher known as LCFR and the firm Calif.io. Official vulnerability records later confirmed that the flaws were originally discovered on August 1, 2026, with credits assigned to researchers from Calif, OpenAI, and Wiz.
Before the PHP maintainers published the official 9.2 rating and the CVE identifiers, cybersecurity firm watchTowr and the Computer Emergency Response Team for the European Union (CERT-EU) linked the leak to CVE-2026-109618 and CVE-2026-109619. Both the initial Hacker News post and watchTowr initially assessed the flaws at the maximum possible score of 10.0 on the CVSS scale, before the official v4.0 vectors established the 9.2 rating (under the older CVSS v3.1 scale, CVE-2026-109618 is rated 9.8 and CVE-2026-109619 is rated 8.1).
Researchers at watchTowr stated that they had internally reproduced CVE-2026-109618 prior to the patch release but withheld the technical mechanism to prevent widespread abuse. Benjamin Harris, chief executive officer (CEO) of watchTowr, confirmed the severity of the breach shortly after the embargo collapsed. “In the last hour, two remote code execution vulnerabilities in PHP leaked. These vulnerabilities were previously scheduled under embargo and were set for disclosure on Thursday at 11 a.m. ET,” Harris said. He emphasized that the threat was verified: “Although we cannot share technical information at this time for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both have a CVSS score of 10 and are understood to affect PHP versions 5, 6, 7, and 8.”
Early exploitation attempts recorded by Cloudflare and Amazon Threat Intelligence
While initial assessments on the day of the forum leak showed no widespread breaches, network defenders quickly spotted attackers probing web servers. At 07:43 UTC on Wednesday (21), more than six hours before the patches were released, Cloudflare chief technology officer (CTO) Dane Knecht reported that the company had begun detecting early attack attempts targeting PHP-based websites. Security vendor Sansec projected that mass automated scanning and exploitation would begin within 15 minutes of the official patch release, as attackers compare the updated source code against older versions to reverse-engineer the flaws.
See also: Bill Gates warns advanced AI models will trigger surge in cyberattacks
Subsequent forensic analysis by Amazon Threat Intelligence revealed that the earliest known exploitation attempt actually predated the public leak by four days. Telemetry from Amazon’s MadPot sensor network recorded an attack targeting the php2shell flaws on Saturday (17), originating from an IP address linked to a commercial anonymization network. On Wednesday (21), between 02:00 UTC and 08:00 UTC, Amazon sensors detected multiple proof-of-concept exploits and varied payloads coming from different anonymized infrastructures, indicating that several distinct threat actors had acquired the exploit prior to the 14:00 UTC patch release.
The potential impact spans a massive portion of the internet, as PHP serves as the foundational scripting language for content management systems such as WordPress and major e-commerce platforms including Magento, Shopware, and WooCommerce. The moniker php2shell references historical, high-impact flaws and highlights an attacker’s ability to gain a remote command terminal (shell) running with the privileges of the web server’s PHP worker account.
Memory corruption mechanics and highest-risk server configurations
With the release of the security advisory on Wednesday (21), the PHP project disclosed the exact technical root causes of both vulnerabilities and confirmed that all PHP versions from 5.4 through 8.5 are affected. Every PHP installation that serves web requests is considered at risk, including setups using Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.
The PHP security team rated Apache mod_php deployments as the highest-risk environment. In mod_php configurations, an unauthenticated HTTP request can trigger a demonstrated exploit before any application-level code even executes, meaning security plugins or application-layer hardening cannot block the attack. While the security team validated a complete exploit chain against mod_php, it noted at the time of release that a complete exploit had not yet been demonstrated against PHP-FPM, though those installations remain vulnerable and require immediate patching.
The two vulnerabilities stem from flaws in how the PHP interpreter handles memory and request states:
- CVE-2026-109618 (Out-of-memory handling flaw): PHP relies on the longjmp() function during out-of-memory (OOM) errors to exit the active context and abort request processing. In specific contexts, the runtime fails to properly account for this jump, leaving request memory in an uninitialized state prior to an allocation. During the cleanup procedure of a subsequent request, the server may read or branch on this uninitialized memory, allowing attackers using targeted OOM strategies to achieve remote code execution.
- CVE-2026-109619 (Stale global state pointer): The PHP engine maintains various global states that temporarily point into request memory. Under certain conditions, these global states are either not properly reset or get repopulated after a reset, leaving pointers directed at request memory that has already been freed. Subsequent web requests can read or branch on this stale state before full initialization occurs, providing a second pathway to remote code execution.
Release parameters, patched versions, and end-of-life exposure
The emergency rollout established the following technical parameters for system administrators and cloud operators:
Check out: WhatsApp blocks account logins on outdated Android and iOS devices
- Vulnerability identifiers: CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp).
- Official severity ratings: 9.2 (Critical) on the CVSS v4.0 scale for both flaws.
- Official patch release timestamp: Wednesday, October 21, 2026, at 14:00 UTC (11:00 a.m. BRT / 10:00 a.m. EDT).
- Original embargo schedule prior to leak: Thursday, October 22, 2026, at 11:00 a.m. ET.
- Affected software range: All PHP versions from 5.4.0 up to the patched 8.x releases.
- Patched official releases: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35.
Only the four actively supported branches of the language—PHP 8.2, 8.3, 8.4, and 8.5—received official compiled update packages from the project. Legacy branches that have already reached their end-of-life (EOL) stage, including PHP 5.x, 7.x, 8.0, and 8.1, do not receive standard official maintenance releases. However, recognizing the widespread use of older runtimes, the PHP team published minimal source code backports for versions 7.4, 8.0, and 8.1 so that Linux distributions and commercial hosting vendors can compile their own fixes.
Server mitigation steps and warnings over fake proof-of-concept repositories
The PHP security team emphasized that no configuration change serves as a complete substitute for installing versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting the PHP service so the updated binaries load into memory. In Security Advisory 2026-018, CERT-EU advised organizations that cannot patch immediately to consider isolating internet-facing PHP applications.
For administrators managing legacy systems between versions 5.4 and 8.1 or awaiting maintenance windows, security vendors and cloud providers outlined temporary risk-reduction measures. Following recommendations from the PHP security team, cloud host Clever Cloud disabled upload progress tracking in sessions across its Apache instances by setting the directive session.upload_progress.enabled to Off. Earlier on Wednesday (21), Sansec had also suggested temporarily blocking multipart/form-data requests at the web server level, though hosting providers noted that blocking such requests outright can break standard file-upload features in web applications.
Major cloud platforms moved quickly to shield managed environments. Google Cloud began rolling out updated serverless base images for App Engine, Cloud Run, and Cloud Functions for Firebase, while Amazon Web Services (AWS) upgraded Amazon WorkMail to PHP 8.3.36 and released updated platform packages for AWS Elastic Beanstalk. Sophos also took its legacy MyUTM licensing portal offline on Wednesday (21) as a precaution to update an affected PHP runtime, reporting no evidence of compromise in its server logs. Meanwhile, cybersecurity researchers warned administrators to avoid downloading unverified proof-of-concept (PoC) scripts for php2shell circulating on public code repositories, noting that several archives contain trojanized malware designed to compromise security testers.
