PHP2Shell (CVE-2026-109618 & CVE-2026-109619)

PHP2Shell is the name for two critical flaws in the PHP engine, the language behind roughly 70% of websites. CVE-2026-109618 is memory corruption that happens when PHP hits an out-of-memory condition and leaves internal request data in an unsafe state. CVE-2026-109619 is stale request state: data that outlives the memory it points to, so the next request handled by the same PHP worker can act on it. PHP confirmed both can give an attacker code execution without logging in.

Because the bugs sit in PHP rather than in one application, PHP said all installations serving web requests were at risk (PHP-FPM, Apache with mod_php at highest risk, php-cgi, FrankenPHP and LiteSpeed), including WordPress, Drupal and Joomla sites. Details leaked before the coordinated release on 21 October 2026, and Amazon reported an exploitation attempt dating back to 17 October. CISA added both to KEV on 26 October.

Reports of “successful attacks” came fast and some were premature, which is a good reason to read the primary evidence. The confirmed case, on 24 October, was remote code execution against an intentionally favourable single-worker mod_php honeypot. The fix is simple to state: upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (PHP says no configuration change fully closes it), and remember appliances and products that embed their own PHP. Two days later PHP disclosed a separate, still-unpatched flaw (CVE-2026-115560) that needs an unusual session configuration; setting session.upload_progress.enabled=0 blocks it.