Software security | Vulnerabilities

PHP Ships Emergency Fixes for PHP2Shell Flaws After Public PoC

PHP shipped emergency fixes for two critical flaws that can let attackers run code on web servers without logging in, as test code circulates.

By Content Team

Oct 22, 2026

ON THIS PAGE

PHP has released emergency fixes for two critical vulnerabilities, collectively called PHP2Shell, after a public proof-of-concept repository dropped verification tools and a lab setup for security testing. Both flaws, CVE-2026-109618 and CVE-2026-109619, score 9.2 on CVSS v4.0. PHP’s advisory says researchers validated unauthenticated remote code execution over HTTP against Apache’s mod_php with default settings.

One flaw stems from how PHP handles running out of memory mid-request; the other lets long-running workers carry stale memory from one request into the next, with session upload progress among its confirmed paths.

The fixes landed October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. After upgrading, restart PHP workers and confirm every web-facing service runs the patched build, because updating the command-line package alone may miss PHP-FPM or Apache’s module.

Threat intelligence firm Mallory counted 883 717 internet-facing hosts on PHP 8.1 or earlier, which the PHP project no longer patches, though some Linux distributions and long-term support vendors may backport fixes.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?