PHP2Shell: Critical PHP Flaws Patched; What Website Owners Must Do Now

On Wednesday, 21 October 2026, the PHP project released emergency updates for two critical flaws in PHP, the language behind WordPress, Drupal, Joomla and a large share of the web. The bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and the researchers who found them call them PHP2Shell. In some setups, an attacker can run code on a server without logging in. PHP’s own security team rates both flaws 9.2 out of 10 on the CVSS v4.0 scale.

Key takeaways

• PHP released fixes on October 21 for two critical flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 by PHP.
• Patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older get no official release.
• Site owners should update PHP and restart workers now, or ask their host; temporary mitigations do not fully protect servers.

If you run a website, blog, online shop or intranet on PHP, this alert needs action today.

Fixed versions at a glance

Linux distributions and long-term-support vendors received the patches in advance, so their fixed packages may carry different version numbers.

What exactly is broken

Both flaws involve memory left in a bad state after PHP hits a fatal error, typically when it runs out of memory partway through a request. PHP’s advisory describes them like this:

• CVE-2026-109618: out-of-memory handling “can interrupt PHP while internal request data is only partially initialized.” The cleanup code may then treat that invalid data as valid.
• CVE-2026-109619: “request-owned internal state can survive after its backing memory has been freed.” A later request handled by the same worker process may then use that stale state.

Wiz Research, which found the bugs, traces them to session upload-progress handling, the fatal-error backtrace feature and OPcache shared memory. Its central point is that the bugs are in PHP itself, not in any plugin or CMS. “Exploitation does not require one of these CMSs, as the vulnerable code is in PHP itself,” Wiz wrote. It added that even a simple “Hello World” app on an affected version could be vulnerable. In its lab, Wiz showed unauthenticated code execution against WordPress, Drupal and Joomla.

Who is exposed

According to PHP’s advisory, the risk covers “all PHP installations serving web requests”. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, which covers the usual ways PHP runs behind a web server. The PHP team rates the risk highest for mod_php, where it has seen a working exploit in which an unauthenticated request “can trigger the attack before any application code runs.” In that case, a security plugin inside WordPress may not help, because the attack lands before the plugin loads.

The problem is also old. Wiz says every PHP version released in the past decade has at least one of the two bugs, going back to PHP 5.4. Sites still running PHP 8.1 or older are in the hardest position, because the PHP project no longer ships official fixes for those versions.

How it was found, and how it went public

According to Wiz’s timeline, its researchers found the first bug on 19 August and confirmed unauthenticated attacks on Drupal and WordPress over the following two days. They reported the bugs to PHP on 24 August. PHP acknowledged them on 21 September, and the fix and public disclosure followed on 21 October. PHP gave advance notice on 20 October and scheduled the release for 14:00 UTC the next day.

AI played a central role. Wiz says it used its own Wiz Atlas tool together with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. TechCrunch reported that the security firm Calif, working under OpenAI’s “Patch the Planet” initiative, used GPT-5.6 Sol to find one of the flaws. Wiz also warned that the same tools help attackers: “LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts.”

Are attackers already using it?

The reports differ, and the differences matter. OpenAI said there were “no reports of exploits in the wild” when the flaws were disclosed, according to TechCrunch. On the same day, BleepingComputer reported that Cloudflare chief technology officer Dane Knecht said Cloudflare was seeing early attacks on both flaws and had deployed temporary firewall rules. Patchstack said hosting partners had reported exploitation incidents early on 21 October. By 13:57 UTC, however, its own data showed only probing, with no hard evidence of breaches. Patchstack expects that to change now that the details are public.

Official warnings have been blunt. According to TechCrunch, the US National Security Agency said that a website that cannot be patched immediately should be taken offline until it can be. BleepingComputer reported that the UK’s National Cyber Security Centre gave similar advice.

A practical checklist for site owners

1. Find your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. On a server you manage, run php -v. On shared hosting, check the PHP selector in your control panel.
2. Update to a patched release or your distribution’s patched package, then restart PHP-FPM or the web server so that every worker loads the new code.
3. On shared hosting, ask your host directly whether its servers are patched. You cannot patch PHP from inside WordPress.
4. If you are on PHP 8.1 or older, plan an upgrade now.
5. Ignore “quick fix” plugins and copied code snippets. Patchstack warns that they are unverified and can break sites.

For administrators who need a few hours, PHP lists temporary measures. For the first flaw: set memory_limit=-1, preferably through php_admin_value, lower post_max_size to 8M (or 32M if uploads are needed), and enforce request limits at the web server. For the second: set session.upload_progress.enabled=0 in php.ini or the FPM pool and restart every worker. PHP says these measures reduce exposure but do not make a server safe. In its release notes it states: “There are no complete mitigations, updating is the only safe choice.” Cloudflare’s rules help only when all traffic goes through Cloudflare.

Watch for warning signs as well. Wiz and Patchstack point to unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, oversized or malformed PHPSESSID cookies, and unexplained restarts of PHP workers. If you see these on an unpatched server, Patchstack advises treating it as possibly compromised and changing the passwords and keys it stores.

The bigger picture

PHP2Shell shows AI models finding serious bugs in code that millions of sites depend on, while the same models can help attackers build exploits faster. Patching quickly has always been good advice; this week it is urgent. More updates are in our Technology section.

Sources

• PHP.net: Security advisory and PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 releases (21 Oct 2026)
• Wiz Research: PHP2Shell, critical RCE vulnerabilities in PHP
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
• Patchstack: Major security alert, PHP vulnerable to critical RCE
• TechCrunch: OpenAI and Wiz find long-standing PHP holes (21 Oct 2026)

Drafted with AI assistance; fact-checked and edited by Ajay Mahawar, Taaza Khabar.