Technology & AI
International / unresolved
PHP Developers Release Emergency Patches for Critical Remote Code Execution Flaws Two critical remote code execution vulnerabilities, dubbed "php2shell," received emergency patches on October 21, 2026, impacting PHP installations globally.
By PrimaryBrief newsroom Published Oct 24, 2026, 3:13 PM EDT
Original PrimaryBrief article graphic. Not a photograph of the event. THE PRIMARY BRIEF 01 · The primary finding PHP developers released emergency patches on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as "php2shell," both rated 9.2 CVSS v4.0 [1] [3] [7] [9] . A third RCE flaw, CVE-2026-115560, was disclosed on October 23, 2026 [4] [5] .
02 · The primary evidence Exploitation attempts for "php2shell" were observed as early as October 17, 2026, by Amazon [5] [13] [17] . Patches were issued for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, with source backports for older versions [1] [2] [11] [17] .
03 · Why it matters These vulnerabilities affect all PHP installations serving web requests, including popular applications like WordPress and Drupal, potentially exposing a vast number of websites and servers to unauthenticated remote code execution [6] [7] [8] [10] [15] .
27 cited sources · 27 independent publishers
PHP developers released emergency patches on October 21, 2026, addressing two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated with a CVSS v4.0 score of 9.2 [1] [3] [7] [9] . These flaws, collectively known as "php2shell," allow unauthenticated attackers to execute code on affected systems [2] [10] [12] .
The vulnerabilities affect nearly all PHP installations serving web requests, including popular platforms like WordPress and Drupal, putting a vast number of websites and servers at risk of compromise [6] [7] [8] [10] [15] .
What the records show The timeline What changed and for whom What we could not confirm SHOW YOUR WORK
Evidence cited (27) ↗ 1. (October 22 2026) RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.↗ 2. (October 21 2026) Two critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service. AWS services are not impacted by these issues. Customers using the affected versions of PHP within the services listed below could be impacted and should ↗ 3. (October 23 2026) Executive Summary. Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). The vulnerabilities are being referred to as PHP2Shell. We encourage reviewing the PHP Group's security advisory and patching guidance. PHP is widely used across web servers and content management systems globally. We recommend assessing your exposure to these vulnerabilities and patching i↗ 4. (October 23 2026) PHP's advisory frames CVE-2026-115560 as a code execution issue reachable only through a specific sequence of session-handling moves. The vulnerable surface is session.upload_progress, the built-in feature that writes upload progress data into $_SESSION so applications can show progress bars without a separate ...↗ 5. (October 23 2026) The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called session upload progress until a fix is available in ...↗ 6. (October 22 2026) The PHP team is handling CVE-2026-115560 in the regular release cycle because the RCE requires an unlikely runtime switch of the session serialize handler within application code, making network-level detection difficult until the full advisory is published alongside the next release. UPDATE (Oct. 22): TrendAI has released an online tool (PHP2Shell — See the Risk. Own the Response) that allows users to identify potential PHP2Shell exposure and take the next step with guidance f↗ 7. (October 20 2026) On 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP [1]. Public reports indicated that these vulnerabilities could lead to remote code execution [2,3]. The PHP team released the fixes today, 21 October 2026 at 13:30 UTC, in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 [4]. Both vulnerabilities can allow unauthenticated remote code execution. Technical details are now being discussed publicly, and initial ..↗ 8. (October 23 2026) ... Critical PHP vulnerabilities could allow unauthenticated remote code execution, prompting emergency security updates and urgent patching. Successful exploitation could allow attackers to execute arbitrary code within the PHP application process, potentially compromising the affected server and exposing sensitive data, application files, or connected databases, depending on the process privileges and system configuration. FortiGuard Labs is monitoring the PHP2Shell vulnerabi↗ 9. (October 21 2026) Vulnerability background
PHP is a widely-used, server-side scripting language that powers many websites, content management systems, and web applications. On Oct. 21, 2026, CVE.org assigned the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. The official Common Vulnerability Scoring System (CVSS) base severity score for each of the PHP flaws has been determined as Critical, a severity of 9.2. Generally, this ranking means that threat actors can crash and hijack the af↗ 10. (October 23 2026) Purpose. CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php (Note: PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Organizations should immediately upda↗ 11. (October 23 2026) On October 21, 2026, the developers of PHP released emergency security updates for two critical vulnerabilities in the PHP core interpreter, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (CVSS v4.0) and can allow an unauthenticated attacker to run code remotely on an affected web server. Because details of these ...↗ 12. (October 22 2026) What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)? PHP2Shell, otherwise known as CVE-2026-109618 and CVE-2026-109619, are two Remote Code Execution vulnerabilities in PHP, a scripting language used to build and run web applications and websites. Both allow an unauthenticated attacker to execute their own code on a server running PHP, potentially taking control of it. CVE-2026-109618 is triggered when PHP runs out of memory partway through setting up a request, leaving int↗ 13. PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. Their existence was publicly announced on 20 October 2026. An emergency patch for ... The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. Patches. edit. The maintainers of PHP r↗ 14. (October 22 2026) What is the PHP2Shell vulnerability? PHP2Shell is the name given to two newly disclosed critical vulnerabilities in PHP itself. Both vulnerabilities come down to the same problem: PHP doesn't clean up properly when a request fails halfway through. An attacker can deliberately cause that failure and abuse the mess it leaves behind. CVE-2026-109618 (RCE via OOM corruption). An unauthenticated attacker can send a crafted multipart POST request that exhausts PHP's per-request memor↗ 15. PHP2Shell is a family of critical vulnerabilities recently fixed in core PHP, with severity reaching CVSS 9.2, that can allow unauthenticated attackers to execute code or expose sensitive process memory. PHP powers approximately 70% of websites, including platforms such as WordPress, Drupal and Wikipedia's MediaWiki. Research and responsible disclosure:Wiz ...↗ 16. (October 21 2026) PHP2Shell covers two memory-safety vulnerabilities in how PHP handles failures while processing a request, in particular running out of memory. The flaws sit in PHP's runtime, so your application code can be sound and the server still vulnerable. PHP reports a demonstrated exploit against Apache with mod_php where ...↗ 17. (October 21 2026) CVE-2026-109619: Stale state crosses request boundaries · Fatal-error backtraces (PHP 8.5 only): Fatal-error reporting keeps backtrace state after shutdown. · Upload processing: After a fatal error, upload processing can leave session or decoder state behind.↗ 18. (October 22 2026) CVE-2026-109619 · Description. A flaw was found in PHP's error handling and worker process state management. · Statement. An unauthenticated remote attacker can trigger memory corruption leading to potential arbitrary code execution. · Mitigation. See the security bulletin for a detailed mitigation procedure.↗ 19. (October 21 2026) CVE-2026-109619 ("php2shell") targets PHP's session.upload_progress callback, which fires on any POST endpoint before application code runs. The exploit body is only ~450 bytes, so size-based WAF rules do not help. The session.upload_progress.enabled = Off mitigation ...↗ 20. (October 23 2026) PHP Issues Follow-Up Advisory on Unlikely Session Upload Progress RCE Vector (CVE-2026-115560) ... On October 23, 2026, the PHP project published an informational advisory recommending that administrators set session.upload_progress.enabled=0 until the next regular bugfix release. This fully protects against an unlikely remote code execution (RCE) vector now tracked as CVE-2026-115560. The recommendation builds directly on mitigation guidance issued two days earlier and applies↗ 21. (October 23 2026)
* Set session.upload_progress.enabled = 0 in effective server-level PHP configuration and restart every worker. PHP confirms this blocks session-related attack paths, not all variants. Do not rely on ini_set() or FPM .user.ini : the configuration must apply before request parsing.
* On PHP 8.5, set fatal_error_backtraces = 0 and restart workers to block the confirmed fatal-backtrace path (again, not all variants).
* Remove invalid/deprecated per-request setti↗ 22. (October 21 2026) The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging all PHP users to update immediately. “These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.↗ 23. (October 22 2026) On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service handling website traffic. We first alerted WordPress site owners to these updates in our initial public service announcement. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and each has a CVSS v4.0 score of 9.2 out of 10. These are not vulnerabilities in WordPress Core, a plugin, ↗ 24. (October 21 2026) Skip to main content php 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 are out for CVE-2026-109618 and 109619. things to check besides just updating : r/PHP. Latest trends in PHP frameworks. Clear search. Search Reddit. Latest trends in PHP frameworks. Best practices for PHP security. Top PHP libraries for web development. How to optimize PHP performance. PHP vs Python for web applications. Open App. Quick security check. Complete the check below to continue. Skip to Navigation Skip to Rig↗ 25. (October 22 2026) 🛡️ PHP version 8.2.35, 8.3.36, 8.4.27 and 8.5.12. ... RPMs of PHP version 8.5.12 are available in the remi-modular repository for Fedora ≥ 43 and Enterprise Linux ≥ 8 (RHEL, Alma, CentOS, Rocky...). RPMs of PHP version 8.4.27 are available in the remi-modular repository for Fedora ≥ 43 and Enterprise Linux ≥ 8 (RHEL, Alma, CentOS, Rocky...). RPMs of PHP version 8.3.36 are available in the remi-modular repository for Fedora ≥ 43 and Enterprise Linux ≥ 8 (RHEL, Alma, CentOS, Rock↗ 26. (October 22 2026) We didn't block multipart/form-data requests, as this could break your applications. The PHP security team validated this attack path against mod_php , but hasn't demonstrated a complete exploit against PHP-FPM, which our PHP instances use. PHP 8.2. 35, 8.3. 36, 8.4. 27 and 8.5. 12 are now available on Clever Cloud, and we are redeploying your PHP applications so they use them automatically. If your application uses one of these branches, you have nothing to do. PHP 8.1 and ear↗ 27. (October 21 2026) Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now. The announcement on php.net contains and references technical details on the vulnerabilities, attack vectors, and instructions on how to update on which systems. This post isn't about how to uThis report is synthesized from the public records, official statements, filings, court documents and published reporting cited above, and reports official proceedings fairly and accurately. Allegations in civil complaints or indictments are not findings of liability or guilt. Inspect each cited source in the evidence panel.
Submit primary documentation or an official response