Two critical PHP RCEs allow unauthenticated remote code execution — immediate updates urged for widely used PHP

PHP development team (PHP Foundation) published an emergency security release on 2026-10-21 that fixes two remote code execution (RCE) vulnerabilities in PHP core. The CVE identifiers are CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2 (Critical). The patched releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. According to W3Techs, about 70% of websites whose server-side language is known use PHP, and because of the wide scope of impact these issues have been dubbed "php2shell."

The first vulnerability, CVE-2026-109618, is triggered at the instant PHP reaches its memory_limit during request processing. When memory is exhausted, internal data that have not completed initialization can be treated as "valid data," which can result in arbitrary code execution. In Apache mod_php configurations an unauthenticated single request can succeed before application code runs, and full RCE was reproduced under default settings, according to reports. The second issue, CVE-2026-109619, is a use-after-free vulnerability where stale internal state persists across requests and can be abused when the same worker handles subsequent requests.

The impact spans all major execution configurations, including PHP-FPM, Apache (mod_php), php-cgi, FrankenPHP, and LiteSpeed. Security firm Wiz reported proofs of concept against major CMSs such as WordPress, Drupal, and Joomla, and additionally confirmed memory disclosure channels that can expose sensitive data like passwords, tokens, API keys, and certificates.

The disclosure timeline was also turbulent. The CVE identifiers leaked externally on 2026-10-20, a day before the planned 10-22 announcement, and were circulated with an incorrect CVSS score (10.0). The PHP project moved the announcement up by one day. At the time of the public release no working exploits had been observed, but proof-of-concept (PoC) code had already been published. On 10-21 CISA issued an alert calling for "immediate patching," and the FBI cyber division also warned about the threat.

The top priority is immediate update to the patched releases (8.5.12/8.4.27/8.3.36/8.2.35). The PHP project notes that major Linux distributions have already provided backported patches in their packages, so using distribution-provided builds is recommended. Environments still running unsupported PHP versions 5.x–8.1 have no available fixes; as mitigations they should set session.upload_progress.enabled = Off in php.ini and reduce direct Internet exposure by placing services behind a WAF or VPN. Security firm Huntress urges organizations to inventory all running PHP instances, including bundled php.exe/php-cgi.exe in vendor software, cPanel/Plesk environments, and CMS platforms such as WordPress.

These vulnerabilities trace back to signs found during PHP's first external security audit in 2024 by Quarkslab (via OSTIF, funded by Sovereign Tech Agency), and in August 2026 researchers and OpenAI independently reported exploitable RCEs, which pushed the fixes to top priority. The PHP Foundation described the situation as a "structural failure relying on a small security team," and advises companies and developers running services on PHP to use this incident to review their PHP versions and support lifecycles.