PHP security review: CVE-2026-109618 and CVE-2026-109619 Explained

PHP security review of CVE-2026-109618 and CVE-2026-109619 shows two critical remote code execution issues in the PHP core that allow unauthenticated attackers to take control of web servers. Both vulnerabilities carry a CVSS v4.0 score of 9.2 and were disclosed on October 20, 2026, with emergency patches released the next day. Organizations running PHP on web servers must verify versions and apply fixes without delay to block active exploitation attempts already observed in honeypots.

Technical Details of the PHP2Shell Vulnerabilities

CVE-2026-109618 involves a use-after-free condition during out-of-memory handling. PHP calls longjmp() to abort a request, yet certain allocation paths leave request memory uninitialized. Cleanup routines later read or branch on that memory, opening a path to remote code execution. Researchers demonstrated reliable triggers through multipart form parsing.

CVE-2026-109619 stems from stale global state that persists across requests on the same worker process. Error handlers, session data, and OPcache can retain pointers to freed request memory. A subsequent request can then reuse that state before proper reset, enabling code execution. Confirmed vectors include fatal-error backtraces in PHP 8.5 and the default-enabled session.upload_progress feature.

Both issues fall under CWE-416 memory corruption. The PHP Group confirmed complete unauthenticated remote code execution on mod_php with default settings. FPM configurations remain susceptible though exploitation reliability varies by setup. Public proof-of-concept code and an exploit tool named PHP2Shell appeared within hours of disclosure.

Affected Versions, Impact, and Immediate Actions

Versions prior to the October 21, 2026 releases remain exposed: PHP 8.2.x below 8.2.35, 8.3.x below 8.3.36, 8.4.x below 8.4.27, and 8.5.x below 8.5.12. Older branches at or below 8.1 are end-of-life and received only minimal backports. Every web-serving SAPI faces risk, with the highest exposure on mod_php because attacks can succeed before application code executes.

Successful exploitation grants remote code execution as the web server user, enabling full application or server takeover and potential memory disclosure. Any PHP-based application, including WordPress, Drupal, Laravel, and Magento installations, can serve as an entry point. Telemetry from security vendors indicates more than 22 million exposed instances at the time of disclosure.

Administrators should inventory all PHP installations, prioritize mod_php environments, and apply the emergency releases from official PHP sources or distribution repositories. Red Hat rates the issue Important and notes that FPM worker exit behavior can reduce reliability of some attack paths on standard RHEL systems. CISA and other agencies advise urgent patching alongside monitoring for anomalous request patterns.

Web Hosting Security Risks and Ongoing Monitoring

Shared and managed hosting providers face elevated exposure because many still run older PHP versions or allow mod_php. Hosts should accelerate rollout of patched binaries and consider temporary isolation of vulnerable workers. Site owners can reduce risk by switching to PHP-FPM with conservative worker limits while patches propagate.

Active exploitation attempts began immediately after disclosure, primarily through the session upload-progress path. Continued scanning is expected as public tools spread. Logging of fatal errors and unexpected memory behavior provides early indicators of attempted attacks.

Regular version checks, automated update pipelines, and prompt response to PHP Group announcements remain the most effective defenses. Organizations that delay updates leave production environments open to takeover even when application code itself contains no flaws.