# PHP Developers Release Emergency Patches for Critical Remote Code Execution Flaws

> Two critical remote code execution vulnerabilities, dubbed "php2shell," received emergency patches on October 21, 2026, impacting PHP installations globally.

By PrimaryBrief newsroom · Published 2026-10-24T19:13:46.079345Z
Canonical: https://primarybrief.com/article/php-developers-release-emergency-patches-for-critical-remote-code-execution-flaws-9985e0f5

PHP developers released emergency patches on October 21, 2026, addressing two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated with a CVSS v4.0 score of 9.2 [1][3][7][9]. These flaws, collectively known as "php2shell," allow unauthenticated attackers to execute code on affected systems [2][10][12].

The vulnerabilities affect nearly all PHP installations serving web requests, including popular platforms like WordPress and Drupal, putting a vast number of websites and servers at risk of compromise [6][7][8][10][15].

## What the records show
The "php2shell" vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are critical RCE flaws rated 9.2 on the CVSS v4.0 scale [3][9][12]. CVE-2026-109618 involves RCE via out-of-memory corruption, where PHP's internal request data is partially initialized, leading to invalid data being treated as valid during cleanup [1][7][14]. CVE-2026-109619 relates to RCE via stale global state, stemming from flaws in PHP's error handling and worker process state management [1][18]. These vulnerabilities allow an unauthenticated actor to execute arbitrary code, read process-accessible data, or cause denial of service by sending crafted web requests to affected PHP workers [2][12]. The issues impact all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed [6][7][10]. PHP versions from 5.4 through 8.5 are affected [13][12]. A separate RCE flaw, CVE-2026-115560, was disclosed on October 23, 2026 [4][5]. This vulnerability is tied to session upload progress handling and runtime changes to the serialize handler [4].

## The timeline
On October 17, 2026, Amazon's threat intelligence observed exploitation attempts against the "php2shell" vulnerabilities [5][13][17]. On October 20, 2026, the PHP project announced an upcoming security release addressing critical vulnerabilities [7][13]. On October 21, 2026, PHP developers released emergency patches for CVE-2026-109618 and CVE-2026-109619 [2][7][8][11]. On October 23, 2026, PHP disclosed CVE-2026-115560, a third RCE vulnerability [4][8].

## What changed and for whom
Patches were released for supported PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 [1][2][7][17]. Source backports were provided by the PHP security team for older, out-of-support versions like PHP 7.4, 8.0, and 8.1 [11][17]. However, older versions like PHP 5.4 through 8.1 are considered end-of-life and migration to a supported branch is required for a complete fix [2]. Organizations using PHP are urged to update immediately to the patched releases to mitigate the "php2shell" vulnerabilities [2][10]. For CVE-2026-115560, PHP will address the flaw in its regular release cycle rather than via an emergency patch, as it requires specific configuration requirements to be exploited [4][5][6]. A mitigation for CVE-2026-109619 and CVE-2026-115560 involves setting `session.upload_progress.enabled=0` and restarting PHP workers [1][4][17][19]. Both the United States' Cybersecurity and Infrastructure Security Agency (CISA) and CERT-EU issued advisories recommending immediate patching [7][10].

## What we could not confirm
*   The exact number of systems compromised by the "php2shell" vulnerabilities prior to patching.
*   The specific types of attackers or organizations behind the observed exploitation attempts.

## Evidence cited
1. (October 22 2026) RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid. — https://plesk.com/
2. (October 21 2026) Two critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service. AWS services are not impacted by these issues. Customers using the affected versions of PHP within the services listed below could be impacted and should  — https://amazon.com/
3. (October 23 2026) Executive Summary. Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). The vulnerabilities are being referred to as PHP2Shell. We encourage reviewing the PHP Group's security advisory and patching guidance. PHP is widely used across web servers and content management systems globally. We recommend assessing your exposure to these vulnerabilities and patching i — https://paloaltonetworks.com/
4. (October 23 2026) PHP's advisory frames CVE-2026-115560 as a code execution issue reachable only through a specific sequence of session-handling moves. The vulnerable surface is session.upload_progress, the built-in feature that writes upload progress data into $_SESSION so applications can show progress bars without a separate ... — https://getastra.com/
5. (October 23 2026) The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called session upload progress until a fix is available in ... — https://thehackernews.com/
6. (October 22 2026) The PHP team is handling CVE-2026-115560 in the regular release cycle because the RCE requires an unlikely runtime switch of the session serialize handler within application code, making network-level detection difficult until the full advisory is published alongside the next release. UPDATE (Oct. 22): TrendAI has released an online tool (PHP2Shell — See the Risk. Own the Response) that allows users to identify potential PHP2Shell exposure and take the next step with guidance f — https://trendmicro.com/
7. (October 20 2026) On 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP [1]. Public reports indicated that these vulnerabilities could lead to remote code execution [2,3]. The PHP team released the fixes today, 21 October 2026 at 13:30 UTC, in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 [4]. Both vulnerabilities can allow unauthenticated remote code execution. Technical details are now being discussed publicly, and initial .. — https://europa.eu/
8. (October 23 2026) ... Critical PHP vulnerabilities could allow unauthenticated remote code execution, prompting emergency security updates and urgent patching. Successful exploitation could allow attackers to execute arbitrary code within the PHP application process, potentially compromising the affected server and exposing sensitive data, application files, or connected databases, depending on the process privileges and system configuration. FortiGuard Labs is monitoring the PHP2Shell vulnerabi — https://fortinet.com/
9. (October 21 2026) Vulnerability background

 PHP is a widely-used, server-side scripting language that powers many websites, content management systems, and web applications. On Oct. 21, 2026, CVE.org assigned the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. The official Common Vulnerability Scoring System (CVSS) base severity score for each of the PHP flaws has been determined as Critical, a severity of 9.2. Generally, this ranking means that threat actors can crash and hijack the af — https://google.com/
10. (October 23 2026) Purpose. CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php (Note: PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Organizations should immediately upda — https://cisa.gov/
11. (October 23 2026) On October 21, 2026, the developers of PHP released emergency security updates for two critical vulnerabilities in the PHP core interpreter, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (CVSS v4.0) and can allow an unauthenticated attacker to run code remotely on an affected web server. Because details of these ... — https://uw.edu/
12. (October 22 2026) What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)? PHP2Shell, otherwise known as CVE-2026-109618 and CVE-2026-109619, are two Remote Code Execution vulnerabilities in PHP, a scripting language used to build and run web applications and websites. Both allow an unauthenticated attacker to execute their own code on a server running PHP, potentially taking control of it. CVE-2026-109618 is triggered when PHP runs out of memory partway through setting up a request, leaving int — https://watchtowr.com/
13. PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. Their existence was publicly announced on 20 October 2026. An emergency patch for ... The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. Patches. edit. The maintainers of PHP r — https://wikipedia.org/
14. (October 22 2026) What is the PHP2Shell vulnerability? PHP2Shell is the name given to two newly disclosed critical vulnerabilities in PHP itself. Both vulnerabilities come down to the same problem: PHP doesn't clean up properly when a request fails halfway through. An attacker can deliberately cause that failure and abuse the mess it leaves behind. CVE-2026-109618 (RCE via OOM corruption). An unauthenticated attacker can send a crafted multipart POST request that exhausts PHP's per-request memor — https://dynatrace.com/
15. PHP2Shell is a family of critical vulnerabilities recently fixed in core PHP, with severity reaching CVSS 9.2, that can allow unauthenticated attackers to execute code or expose sensitive process memory. PHP powers approximately 70% of websites, including platforms such as WordPress, Drupal and Wikipedia's MediaWiki. Research and responsible disclosure:Wiz ... — https://php2shell.com/
16. (October 21 2026) PHP2Shell covers two memory-safety vulnerabilities in how PHP handles failures while processing a request, in particular running out of memory. The flaws sit in PHP's runtime, so your application code can be sound and the server still vulnerable. PHP reports a demonstrated exploit against Apache with mod_php where ... — https://aikido.dev/
17. (October 21 2026) CVE-2026-109619: Stale state crosses request boundaries · Fatal-error backtraces (PHP 8.5 only): Fatal-error reporting keeps backtrace state after shutdown. · Upload processing: After a fatal error, upload processing can leave session or decoder state behind. — https://datadoghq.com/
18. (October 22 2026) CVE-2026-109619 · Description. A flaw was found in PHP's error handling and worker process state management. · Statement. An unauthenticated remote attacker can trigger memory corruption leading to potential arbitrary code execution. · Mitigation. See the security bulletin for a detailed mitigation procedure. — https://redhat.com/
19. (October 21 2026) CVE-2026-109619 ("php2shell") targets PHP's session.upload_progress callback, which fires on any POST endpoint before application code runs. The exploit body is only ~450 bytes, so size-based WAF rules do not help. The session.upload_progress.enabled = Off mitigation ... — https://abstract.security/
20. (October 23 2026) PHP Issues Follow-Up Advisory on Unlikely Session Upload Progress RCE Vector (CVE-2026-115560) ... On October 23, 2026, the PHP project published an informational advisory recommending that administrators set session.upload_progress.enabled=0 until the next regular bugfix release. This fully protects against an unlikely remote code execution (RCE) vector now tracked as CVE-2026-115560. The recommendation builds directly on mitigation guidance issued two days earlier and applies — https://threatlandscape.io/
21. (October 23 2026)   
 
  * Set session.upload_progress.enabled = 0 in effective server-level PHP configuration and restart every worker.   PHP confirms this blocks session-related attack paths, not all variants.   Do not rely on ini_set() or FPM .user.ini : the configuration must apply before request parsing.  
  * On PHP 8.5, set fatal_error_backtraces = 0 and restart workers to block the confirmed fatal-backtrace path (again, not all variants).  
  * Remove invalid/deprecated per-request setti — https://github.com/
22. (October 21 2026) The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging all PHP users to update immediately. “These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. — https://helpnetsecurity.com/
23. (October 22 2026) On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service handling website traffic. We first alerted WordPress site owners to these updates in our initial public service announcement. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and each has a CVSS v4.0 score of 9.2 out of 10. These are not vulnerabilities in WordPress Core, a plugin,  — https://wordfence.com/
24. (October 21 2026) Skip to main content php 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 are out for CVE-2026-109618 and 109619. things to check besides just updating : r/PHP. Latest trends in PHP frameworks. Clear search. Search Reddit. Latest trends in PHP frameworks. Best practices for PHP security. Top PHP libraries for web development. How to optimize PHP performance. PHP vs Python for web applications. Open App. Quick security check. Complete the check below to continue. Skip to Navigation Skip to Rig — https://reddit.com/
25. (October 22 2026) 🛡️ PHP version 8.2.35, 8.3.36, 8.4.27 and 8.5.12. ... RPMs of PHP version 8.5.12 are available in the remi-modular repository for Fedora ≥ 43 and Enterprise Linux ≥ 8 (RHEL, Alma, CentOS, Rocky...). RPMs of PHP version 8.4.27 are available in the remi-modular repository for Fedora ≥ 43 and Enterprise Linux ≥ 8 (RHEL, Alma, CentOS, Rocky...). RPMs of PHP version 8.3.36 are available in the remi-modular repository for Fedora ≥ 43 and Enterprise Linux ≥ 8 (RHEL, Alma, CentOS, Rock — https://remirepo.net/
26. (October 22 2026) We didn't block multipart/form-data requests, as this could break your applications. The PHP security team validated this attack path against mod_php , but hasn't demonstrated a complete exploit against PHP-FPM, which our PHP instances use. PHP 8.2. 35, 8.3. 36, 8.4. 27 and 8.5. 12 are now available on Clever Cloud, and we are redeploying your PHP applications so they use them automatically. If your application uses one of these branches, you have nothing to do. PHP 8.1 and ear — https://clever.cloud/
27. (October 21 2026) Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now. The announcement on php.net contains and references technical details on the vulnerabilities, attack vectors, and instructions on how to update on which systems. This post isn't about how to u — https://thephp.foundation/