Two critical flaws in the PHP language itself, together nicknamed PHP2Shell, now have emergency fixes. Help Net Security reports the PHP team has released updates for CVE-2026-109618 and CVE-2026-109619, which let attackers run code on a web server without logging in, and that the fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Because PHP sits underneath WordPress, Drupal, Joomla and Magento, AppleInsider expects a few days of patching, and with it some website outages.
What’s wrong, and who’s exposed
The PHP security team rates both flaws CVSS v4.0 9.2. The bugs sit in the interpreter, not in any one app. Patchstack says that means any site on a vulnerable PHP version is exposed, whatever CMS or framework it runs.
The first bug, CVE-2026-109618, comes from out-of-memory handling. If PHP runs out of memory while setting up request data, that data is left partly initialised, and request cleanup then treats it as valid, opening a path to code execution. The second, CVE-2026-109619, is a stale-state problem. Request-owned internal state can survive after its memory has been freed, so a later request handled by the same worker may use it before normal initialisation resets it.
The reach is wide. Wiz Research, which reported the bugs to PHP, says every version back to 5.4 is affected by at least one of the issues. Wiz demonstrated unauthenticated code execution against the latest WordPress, Drupal and Joomla container images, and says even a “Hello World” app on a vulnerable version can be exploited. It also showed it could read PHP worker memory, which can hold passwords, tokens and API keys. Help Net Security says the affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php the riskiest, and that a working exploit can trigger the attack with one unauthenticated request before any application code runs.
In a write-up, Wiz researchers called the findings among the most severe ever discovered in PHP. They also said frontier AI models lowered the barrier to turning a decades-old flaw into a working exploit, a claim we haven’t independently verified.
Attacks started before the patch
The timeline went wrong early. The CVE identifiers circulated on Hacker News and social media on 20 October, and later that day the PHP security team published an advance notice of a release set for 21 October at 14:00 UTC. According to watchTowr, the flaws were originally due to be disclosed under embargo on Thursday, 22 October.
Exploitation followed the leak. Patchstack says the flaw is already being actively exploited and lists multiple confirmed incidents. WatchTowr says its honeypot network observed exploitation in the wild as of 21 October. Security researcher Kevin Beaumont, quoted by Help Net Security, said the situation will lead to “a mass of incidents”.
Regulators have also stepped in. CERT-EU published an advisory naming both CVEs. AppleInsider, citing Reuters, says EU cybersecurity officials told organisations that can’t apply the fixes to be ready to take PHP sites offline temporarily. The UK’s National Cyber Security Centre is urging the same for any system that can’t be fixed right away.
What site owners should do
The cure is an upgrade. Help Net Security says Linux distributions and long-term support vendors received the patches ahead of the public release, so admins should check their vendor for updated packages. Anyone relying on the volunteer-run rpms.remirepo.net repository won’t find updates there today, and the report advises switching to distribution packages or building from source.
Older branches are the awkward part. Help Net Security says PHP no longer supports 8.1 and earlier, though some distributions and LTS vendors offer backported fixes. The PHP security team also released minimal source backports for PHP 7.4, 8.0 and 8.1, aimed at people who build from source or have no LTS vendor. Tenable’s pre-release FAQ expected end-of-life branches to get no fixes, so an upgrade to a supported release is the safer route.
If you can’t patch immediately, a web application firewall can buy time. Cloudflare CTO Dane Knecht said in a post on X that PHP sites behind Cloudflare already have an initial set of WAF rules for the known exploit vectors, available to all customers including free plans. Patchstack is blunt that only an update is a complete fix.
For everyone else, there’s little to do. AppleInsider says no patches are needed for browsers or apps, so ordinary users can only wait out any downtime and avoid entering credentials on sites that look broken or half-restored. Hal Pomeranz, a forensics expert quoted by Help Net Security, expects a long tail of forgotten, unmaintained installs that never get fixed.
I just browse the web. Do I need to update anything?
No. AppleInsider says browsers and apps need no patches, because the flaws are on the server side. The practical effect is that some sites may go down or behave oddly while their owners patch.
I run a WordPress or other PHP site. What’s the fastest fix?
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. On shared or managed hosting, ask your provider to confirm they’ve applied the patched packages. We recommend doing that today rather than waiting for a plugin or CMS update, since the bug is in PHP, not in WordPress itself.
What if my server runs PHP 8.1 or older?
Contact your distribution or LTS vendor to ask whether they’ve backported the fix, or move to a supported PHP release. The PHP team has also published minimal source backports for 7.4, 8.0 and 8.1 if you build from source. If none of that is possible, CERT-EU and the NCSC both advise taking the affected system offline until it’s fixed.
