PHP vulnerability: Critical 'php2shell' flaws patched; update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35

The PHP project shipped emergency security releases on Wednesday, Oct. 21, for two critical flaws that can let an unauthenticated attacker run code on a web server. The federal Cybersecurity and Infrastructure Security Agency (CISA) told organizations to patch immediately. “PHP” drew more than 100,000 US searches on Google Trends, with “php vulnerability,” “cve-2026-109618” and “php patch” among the related queries.

What is PHP, and why this matters

PHP is the programming language that runs a large share of the web’s server-side code, including many content management systems and online stores. That reach is why a flaw in PHP itself, rather than in one app, gets this much attention. CISA noted that PHP is often bundled inside other software, so organizations may be running it without realizing.

The two vulnerabilities

Both are rated 9.2 under CVSS v4.0, according to PHP’s advance notice. CISA says the pair is known as “php2shell.”

• CVE-2026-109618, “RCE via OOM corruption.” If a request hits PHP’s memory limit at the wrong moment, PHP can leave internal data half-initialized and later treat it as valid, according to the PHP Foundation. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. RCE was also confirmed on PHP-FPM through application code paths.
• CVE-2026-109619, “RCE via stale state.” A fatal error at the wrong point can leave internal state pointing at memory from a previous request; a later request on the same worker may use that freed memory. The reporter demonstrated RCE against a real-world application on Apache with mod_php, the Foundation said.

PHP’s advisory says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers mod_php the highest risk. Laravel’s Forge documentation says the bugs affect PHP versions dating back to 2004.

As of CISA’s alert, the agency had not observed exploitation in the wild. That can change quickly once details are public.

Which PHP versions fix it

Branch	Fixed version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35
PHP 8.1 and older	No official release (end of life)

The releases went out around 14:00 UTC (10 a.m. ET). Linux distributions and long-term-support vendors got the patches in advance, so PHP says to check your vendor’s packages first. For PHP 8.1 and older, PHP’s security team published minimal source backports for 7.4, 8.0 and 8.1 for people building from source, but the official advice is to upgrade to a supported version or get a vendor backport.

PHP also warned that the volunteer-run rpms.remirepo.net repository “will not have updates today” and urged users relying on it to switch to distribution packages or build from source.

What CISA says to do

• Inventory every system running PHP, including PHP embedded in other products.
• Patch now, starting with internet-facing systems.
• If you can’t update, or still run PHP 8.1 or older, take those systems offline until they’re patched.
• A web application firewall may help temporarily.
• Watch for PHP worker processes launching shells or downloading tools.

Are there workarounds?

Only partial ones. PHP lists stopgaps such as setting session.upload_progress.enabled=0 and lowering post_max_size, but stresses that they “do not make an installation safe.” Updating is the only complete fix.

FAQ

Is my website affected? If it runs PHP and serves web requests, assume yes until you’re on a fixed version.

Is it being exploited? CISA said it had not seen exploitation as of its Oct. 21 alert.

What about shared hosting? Ask your host whether PHP has been updated; on managed platforms like Laravel Forge, PHP must be updated per server.