PHP ships emergency patches for two confirmed PHP2Shell code execution flaws as exploit attempts begin

PHP shipped emergency patches on October 21 for two runtime flaws collectively called PHP2Shell, now confirmed as CVE-2026-109618 and CVE-2026-109619 and rated 9.2, correcting the leaked 10.0 figure. They affect nearly every PHP version back to 5.4, with fixes in 8.5.12, 8.4.27, 8.3.36, and 8.2.35; branches 8.1 and older get no official update. Both live in the PHP runtime, so applications are exposed even with secure code, and the risk is highest under Apache mod_php. Cloudflare and watchTowr reported exploit attempts within hours, though no confirmed compromise. Wiz, Calif, and OpenAI's Codex Security team reported the flaws.

Check

Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 now, prioritizing Apache mod_php hosts, and migrate off end-of-life 8.1 and older.

Affected

Nearly every PHP version back to 5.4 carries two runtime flaws exposing applications to remote code execution and worker-memory reads regardless of the application's own code.

Fix

Install the PHP security releases, confirm distribution packages carry the CVE fixes, watch for exploit attempts now underway, and replace unsupported PHP branches.