PHP has released emergency security updates to address two critical vulnerabilities, collectively known as PHP2Shell, that could allow unauthenticated attackers to execute arbitrary code on vulnerable web servers. Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws have a CVSS v4.0 severity score of 9.2 and affect the PHP runtime itself rather than individual applications.

The vulnerabilities impact nearly every PHP version dating back to PHP 5.4 and affect deployments using Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Apache mod_php is considered particularly vulnerable because exploitation can trigger before application code executes. Researchers also demonstrated remote code execution against PHP-FPM under certain conditions. Additionally, attackers may read PHP worker memory containing sensitive information, including passwords, authentication tokens, API keys, and certificates, without first achieving code execution.

The PHP team has released patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators should upgrade their PHP runtime, restart Apache, PHP-FPM, and long-running PHP workers, and verify that the deployed packages contain the relevant security fixes. Updating applications such as WordPress or Laravel alone does not address vulnerabilities in the underlying PHP runtime. PHP 8.1 and older branches no longer receive upstream updates, although source backports are available for selected older versions. Administrators using distribution-managed packages should verify vendor security advisories and changelogs.

If immediate patching is not possible, temporary mitigations can reduce exposure but do not eliminate the vulnerabilities. For CVE-2026-109618, administrators should configure memory_limit=-1 so applications cannot override it, keep post_max_size low, and enforce request-size limits at the web server or proxy. For CVE-2026-109619, disabling session.upload_progress.enabled and, on PHP 8.5, setting fatal_error_backtraces=0 may block specific attack paths. However, upgrading PHP remains the only complete remediation.

Exploitation attempts have been reported by security firms, with attackers reportedly modifying payloads to bypass web application firewall rules. As of the latest reported update on October 21, 2026, no confirmed successful compromise of a specific server had been publicly reported.

The disclosure process was disrupted by leaked vulnerability details and premature publication of proof-of-concept material. Researchers helped identify and reproduce the flaws. The PHP Foundation also acknowledged that signs of the first vulnerability had emerged during a 2 024 security audit, but work on a definitive fix stalled before the 2026 research demonstrated a practical exploitation path.