Two Critical PHP Flaws Allow Unauthenticated Code Execution, and Patches Are Out

Security · Published 23 October 2026

The PHP project shipped fixes on 21 October 2026 for two critical flaws in its core engine, tracked as CVE-2026-109618 and CVE-2026-109619. CERT-EU's security advisory 2026-018, published the same day, says the PHP team released the patches at 13:30 UTC and rates each flaw at CVSS 9.2. Researchers have grouped the pair under the name PHP2Shell. Both are described as allowing remote code execution without authentication, which means an attacker who can reach a vulnerable server over the network does not need a login.

The advisories list the affected branches as PHP 8.5 before 8.5.12, PHP 8.4 before 8.4.27, PHP 8.3 before 8.3.36 and PHP 8.2 before 8.2.35. PHP 8.1 and older are past end of life and do not get routine upstream updates. For 7.4, 8.0 and 8.1, the project published minimal source backports on separate branches. The affected server setups include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Wiz, whose research was published the same day, says mod_php carries the highest risk.

According to the advisories, one flaw is a memory corruption bug, and the other involves state that carries over between requests in a way it should not. Wiz's write-up frames the discovery as AI-assisted research, and says the issues were demonstrated as exploitable. Rapid7 and CERT-EU both describe the bugs as unauthenticated, which is the reason they score so high.

The reports disagree on how far exploitation has gone. BleepingComputer, reporting on 21 October, says Cloudflare's chief technology officer stated that the company had already seen early attacks aimed at the two flaws before the patches shipped, and that Cloudflare had deployed temporary web application firewall rules. The same report says the UK National Cyber Security Centre told organisations to update immediately or take PHP systems offline. Rapid7 says in-the-wild exploitation is expected and that a working exploit is expected to be published soon. It presents this as an expectation rather than something it has observed. CERT-EU says proof-of-concept code has begun to circulate. None of these sources is a PHP project statement confirming active exploitation.

The practical step is to update to a fixed version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package that includes both fixes. Rapid7 advises treating the update as an emergency change outside normal patch cycles. It also warns that some third-party package repositories may not carry the new builds on release day, so checking the exact package version matters. Vendors list temporary configuration changes that reduce exposure, such as memory limits and turning off per-request diagnostics. Every source reviewed says those steps lower risk but do not replace the update. CERT-EU adds that internet-facing applications should be isolated from public networks until the fix is applied and verified. To check what you run, look at the PHP version your web server or hosting panel reports, and compare it with the list above.

The reach of the problem is hard to measure. PHP runs many content management systems, shop platforms and bundled third-party applications, and some of those ship their own copy of PHP, so a site owner may not know a vulnerable version is inside an application. CERT-EU points to a public repository that helps identify third-party software embedding PHP. Hosting providers and Linux distributions have started publishing their own builds, but the timing varies.

Several things remain unknown. None of the reports gives a count of exposed servers, and none says how many have already been compromised. It is not yet clear whether the early attacks reported by Cloudflare are widespread. The exploit timeline is also uncertain, since Rapid7 and CERT-EU describe public exploit code as expected or circulating rather than confirmed. Anyone running PHP in production should treat this as urgent until the patched version is confirmed on every server.

This article was researched and written by an AI system from the sources listed above, under SavvyToolz's sourcing and freshness rules. Read the editorial policy.