On 21 October 2026, the PHP team released emergency updates for two critical bugs, CVE-2026-109618 and CVE-2026-109619. Researchers call them PHP2Shell. They can allow an attacker to run commands on your server without logging in, and exploit attempts have been observed. Here is what they are and how to fix them.

The two bugs in plain words

• CVE-2026-109618 (out-of-memory corruption): A specially crafted web request can interrupt PHP while it is preparing internal data because of a memory error. During cleanup, PHP may incorrectly trust that incomplete data, potentially allowing an attacker to execute malicious code.

• CVE-2026-109619 (stale data): PHP may retain an internal reference to memory that has already been freed. A subsequent request handled by the same worker can encounter this invalid state, potentially leading to code execution or memory disclosure.

Both vulnerabilities are rated 9.2 out of 10 for severity. The flaws are in PHP itself, not necessarily in your application code or plugins. They affect PHP versions dating back to 5.4, so updating WordPress, Laravel dependencies, or a theme alone will not fix them.

How it could hurt you

These are examples of possible outcomes, not confirmed incidents involving specific companies.

• Online store: An attacker could access customer details and order information or modify the checkout page to steal payment information.
• Startup app: An attacker could access passwords, login tokens, or API keys available in server memory and use exposed credentials to reach customer data or connected cloud services.
• Forgotten old website: An attacker could misuse a compromised site to send spam, host phishing pages, or try to gain access to other systems.

The actual impact depends on the server configuration, the permissions of the PHP process, and the information available to it.

How serious is it?

• Easy to reach: An attacker may be able to exploit a vulnerable server using a web request without an account or password.
• Huge reach: PHP runs about 70% of websites. More than 22.6 million publicly exposed instances that could be vulnerable. This is an estimate of potential exposure, not a count of hacked websites.
• Governments reacted quickly: The US National Security Agency issued a public warning advising organisations to take websites offline if they could not update immediately. CISA, the UK's NCSC, Germany's BSI, Switzerland's NCSC, and EU cybersecurity bodies also issued warnings. Some government websites in the Netherlands, Finland, France, Germany, Belgium, and the Czech Republic were taken offline as a precaution, according to Al Jazeera's reporting.
• Data leaks: Many shutdowns were precautionary, and no verified global count of compromised websites or leaked records linked to these vulnerabilities has been established.

Quick fix: 5 steps

1. Check your PHP version. Run php -v, but also check the version your web server actually uses, because the command-line version can differ. If you do not manage the server, ask your hosting provider or developer.

2. Update PHP. Install one of these fixed releases, or an equivalent security-patched package from your operating-system or hosting provider:

   • PHP 8.5.12
   • PHP 8.4.27
   • PHP 8.3.36
   • PHP 8.2.35

   Linux vendors may backport security fixes without changing the displayed version number, so check the vendor's security notice. Windows users should download the latest applicable Windows packages, including the rebuilt -1 packages released on 26 October, from the official PHP downloads page.

3. Restart the relevant services. Restart PHP-FPM or the relevant web server service, restart long-running PHP workers, and rebuild and redeploy affected containers. Verify that the updated runtime is actually running.

4. Deal with older versions. PHP 8.1 and older no longer receive regular upstream security updates. Check whether your hosting or operating-system vendor offers a backported patch; otherwise, plan an upgrade to a supported version. PHP 8.2 reaches end of security support on 31 December 2026.

5. Check for signs of a break-in. Review server logs for unusual POST requests returning HTTP 500 errors, memory errors, crashing workers, unexpected processes, or modified files. If you suspect a compromise, investigate it and rotate potentially exposed passwords, database credentials, and API keys. An update does not remove an attacker who may already have gained access.

Founders: Ask your developer or hosting provider: "Are all our PHP installations patched, and have the relevant services been restarted?" Ask for confirmation in writing.

Can't update immediately? Restrict access to the affected server or temporarily take it offline until it can be patched. PHP lists limited measures, such as setting session.upload_progress.enabled=0 and lowering post_max_size, to reduce exposure to specific attack paths. These are not complete fixes. The PHP team recommends updating as the only safe solution, so do not rely on a firewall alone.

Official sources

PHP: Official security bulletin and update notes PHP: Vendor advisory on CVE-2026-109618 PHP: Vendor advisory on CVE-2026-109619

Need help reviewing your website?

Contact WebPatriot to discuss a review of your PHP environment and the work required to address affected applications.