php2shell: two critical rce flaws in php itself

what happened

• On 2026-10-21 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities that can allow unauthenticated remote code execution, and told all PHP users to update immediately.[1]
• CVE-2026-109618, "RCE via OOM corruption": PHP's out-of-memory handling can interrupt a request while internal request data is only partially initialized, and request cleanup can then treat that invalid data as valid.[1,2]
• CVE-2026-109619, "RCE via stale global state": request-owned internal state can survive after its memory is freed, and a later request handled by the same worker can use it before normal initialization resets it — a use-after-free.[1,3]
• Both advisories carry a CVSS v4.0 score of 9.2 (vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).[2,3]

who is exposed

• PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.[1]
• PHP considers the risk highest for mod_php, where its advisory describes a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs.[1,2]
• PHP 8.1 and older no longer receive updates from the PHP project; the security team published minimal source backports for PHP 7.4, 8.0 and 8.1 for people building from source.[1]
• Wiz Research, one of the reporters, says nearly every PHP version back to PHP 5.4 is affected by at least one of the two issues.[4]
• Wiz says it demonstrated unauthenticated remote code execution in a lab against the then-latest WordPress, Drupal and Joomla container images.[4]
• W3Techs reports PHP is used by 69.3% of websites whose server-side language it can identify.[7]

how it came out

• On 2026-10-20 PHP posted advance notice of a critical security release scheduled for 2026-10-21 at 14:00 UTC, reserving the right to release earlier if details became public.[1]
• Huntress and The Hacker News report that details leaked on 2026-10-20 through a since-removed Hacker News post and a briefly posted exploit video, ahead of the coordinated disclosure planned for 2026-10-22.[5,6]
• Wiz's published timeline says it reported the first issue to the PHP security team on 2026-08-24. The reporters credited in the GitHub advisories include researchers from Wiz, Calif and OpenAI.[4,2]

exploitation so far

• The Hacker News and Tenable quote Cloudflare's CTO: "We are seeing early attacks emerging and are updating mitigations as new vectors show up."[6,8]
• watchTowr says it observed exploitation through its honeypot network on 2026-10-21; Huntress said it had not yet seen in-the-wild exploitation across its partners as of 10:00 ET that day.[9,5]
• As of 2026-10-21 neither CVE was listed in CISA's Known Exploited Vulnerabilities catalog, according to watchTowr and The Hacker News.[9,6]

if you can't patch today

• PHP's advisory lists partial measures — for example memory_limit=-1 set where applications can't override it, a low post_max_size, session.upload_progress.enabled=0, and on PHP 8.5 fatal_error_backtraces=0, each followed by restarting every worker.[1]
• PHP is explicit that these reduce exposure to specific attack paths but do not make an installation safe; only updating is a complete fix.[1,2,3]
• Linux distributions and LTS vendors received the patches in advance, so updated packages should be available from your OS or hosting vendor.[1]