On October 21, 2026, the PHP project rushed out emergency patches for two critical vulnerabilities nicknamed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 on the CVSS v4.0 scale — a claimed 10.0 circulated briefly but wasn't PHP's own rating. Either way, this is about as serious as web server vulnerabilities get.

Why this one is different

Most web application vulnerabilities live in the application — a WordPress plugin, a custom script, a misconfigured form. These two live in the PHP runtime itself. That means a site built with clean, well-written code can still be exposed, because the vulnerability isn't in anything the site's developers wrote.

Nearly every PHP version back to 5.4 is affected. Fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier are past the point of official support, though given the severity, the project published emergency backported patches for 7.4, 8.0, and 8.1 as well.

What an attacker can do

Both flaws allow unauthenticated remote code execution — no login, no valid session, no user interaction required. The risk is highest on servers running the traditional Apache mod_php setup, where a single malicious request can trigger code execution before any application code even runs. PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed setups are affected too, through a somewhat different path.

Beyond running code outright, one of the two flaws can expose live memory from a PHP worker process — which can mean passwords, API keys, session tokens, or certificates belonging to other requests that happened to share that same worker. That's a meaningful data-exposure risk on its own, separate from the code-execution angle.

Who's affected

Any site or application running PHP: WordPress (which still powers a large share of the web), Laravel, Drupal, and plenty of custom internal tools most businesses don't think of as "web servers" but which quietly run on PHP underneath.

Patching WordPress core or your plugins does not fix this. The vulnerability is in the PHP runtime underneath your application, not in the application itself. You (or your host) need to update PHP directly.

What to do right now

  1. Patch the PHP runtime — through your server's package manager, your hosting provider, or your container base image — then restart Apache, PHP-FPM, and any long-running PHP worker processes. A restart is required; the patch doesn't take effect until the old process is gone.
  2. Verify by changelog, not version string. Some Linux distributions backport security fixes without changing the visible version number, so check your distro's changelog rather than assuming an older-looking version is unpatched.
  3. If you can't patch immediately, there are partial mitigations — setting memory_limit=-1, keeping post_max_size low, enforcing request-size limits at the web server or proxy layer, and disabling session.upload_progress — but none of these are a substitute for the actual patch, and they only partially reduce risk.
  4. After patching, watch for signs of prior compromise: unusual multipart form requests followed by memory-limit errors, repeated HTTP 500 errors, abnormally large session cookies, or PHP worker processes restarting unexpectedly.

Details leaked publicly on October 20, ahead of a planned coordinated disclosure on the 22nd, which is why PHP pushed patches out a day early. Security researchers reported attack attempts within days of disclosure, and CISA issued an alert urging immediate patching. Neither CVE was in CISA's Known Exploited Vulnerabilities catalog as of this writing — but given how fast exploitation attempts started, that status could change quickly.

If CUI touches a PHP-based system

For contractors with compliance obligations under DFARS 252.204-7012, an exposure like this on any system touching Controlled Unclassified Information isn't just a technical problem — it potentially triggers the 72-hour incident reporting requirement if there's evidence of compromise. Knowing definitively whether you're patched, and whether anything was touched before you patched, matters for more than just uptime.

If you manage your own web infrastructure and you're not certain whether PHP itself — not just your application — is current, that's worth confirming today rather than later this week.