---
title: PHP Ships Emergency Fixes for PHP2Shell Flaws After Public PoC
description: PHP shipped emergency fixes for two critical flaws that can let attackers run code on web servers without logging in, as test code circulates.
canonical_url: https://codekeeper.co/ticker/php-vulnerabilities-cve-2026-109618-cve-2026-109619
---

[Software security](https://codekeeper.co/ticker/tag/software-security) | [Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# PHP Ships Emergency Fixes for PHP2Shell Flaws After Public PoC

PHP shipped emergency fixes for two critical flaws that can let attackers run code on web servers without logging in, as test code circulates.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 22, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

PHP has released emergency fixes for two critical vulnerabilities, collectively called PHP2Shell, after a public proof-of-concept repository dropped verification tools and a lab setup for security testing. Both flaws, CVE-2026-109618 and CVE-2026-109619, score 9.2 on CVSS v4.0. PHP’s advisory says researchers validated unauthenticated remote code execution over HTTP against Apache’s mod_php with default settings. One flaw stems from how PHP handles running out of memory mid-request; the other lets long-running workers carry stale memory from one request into the next, with session upload progress among its confirmed paths. The fixes landed October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. After upgrading, restart PHP workers and confirm every web-facing service runs the patched build, because updating the command-line package alone may miss PHP-FPM or Apache’s module. Threat intelligence firm Mallory counted 883 717 internet-facing hosts on PHP 8.1 or earlier, which the PHP project no longer patches, though some Linux distributions and long-term support vendors may backport fixes. Source: [Cybersecurity News](https://cybersecuritynews.com/php2shell-vulnerability/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphp-vulnerabilities-cve-2026-109618-cve-2026-109619%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[200+ GitHub Repos Caught Spreading Windows Malware in Coordinated Attack Aug 12, 2026](https://codekeeper.co/ticker/operation-muck-and-load-malware-campaign)

[Cyberattacks ASOS App Hijacked by Hackers to Send Extortion Message Oct 7, 2026](https://codekeeper.co/ticker/asos-cyberattack-xuanye-group-threat)

[Cyberattacks AI-Powered Attack Hits Dutch Cybersecurity Organization Using Zammad Zero-Days Oct 2, 2026](https://codekeeper.co/ticker/divd-hacked-ai-powered-attack-zammad-zero-days)

[Data breaches OpenAI Agent Breached Australia's Medicare Statistics Portal Sep 29, 2026](https://codekeeper.co/ticker/openai-model-hacks-australian-health-portal)