Memory corruption during out-of-memory (OOM) handling
PHP abandons a request when a memory allocation fails, and cleanup then uses partially initialized internal data.
Security advisory · Critical PHP vulnerability · October 2026
php2shell: unauthenticated remote code execution in PHP
Two critical flaws in the PHP engine itself (CVE-2026-109618 and CVE-2026-109619) let an unauthenticated attacker run commands on your server. They affect every PHP application, however clean its own code, and exploitation has already begun. Patches shipped on 21 October 2026.
- CVSS 9.2 — Critical
- Unauthenticated
- Exploited in the wild · on the CISA KEV list
- In the PHP engine — every app affected
01 — Overview
CVE-2026-109618
CVE-2026-109619
What is php2shell?
“php2shell” is the name given to two critical vulnerabilities disclosed together in the PHP engine in October 2026. The problem is not in your application code — it is in PHP itself, which handles the request before your code runs. Application-level authentication does not protect you, and a site stays exposed even if its code is perfectly clean.
Both flaws come from memory-management errors during request handling. A remote, unauthenticated attacker can abuse them to reach command execution on the server (RCE) or to leak memory contents.
Use-after-free
State left over from one request still points to freed memory, which a later request on the same worker reads.
02 — Affected systems
Are you affected?
The flaws are in the PHP engine, so every runtime is in scope: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Any platform running PHP — including Magento, WooCommerce, Shopware and WordPress — is affected until it is updated.
Clean code is not enough. PHP handles the request before your code runs, so neither authentication nor code review blocks this. Patching is the fix.
PHP 8.5
Fixed in 8.5.12
PHP 8.4
Fixed in 8.4.27
PHP 8.3
Fixed in 8.3.36
PHP 8.2
Fixed in 8.2.35
PHP 8.1 and older
End of life — no official fix (minimal source backports for 7.4 / 8.0 / 8.1)
03 — Severity
01
02
03
04
Why is it so serious?
Unauthenticated
The attacker needs no account or privilege — reaching the site is enough.
Engine-level
Affects every PHP application regardless of its own code quality or framework.
Exploited in the wild
Exploitation has been observed, both CVEs are on the CISA KEV list, and public proof-of-concept tooling exists.
Code execution and memory disclosure
Server takeover, or disclosure of secrets and data from memory such as keys and sessions.
04 — Remediation
How to check and fix
The decisive fix is to update now. If you cannot, apply the interim measures, then update as soon as possible.
1. Check your version
Find the PHP version and runtime on every server:
php -v php-fpm -v # if you use PHP-FPM
2. Update to a patched release
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer) through your package manager, then restart all workers.
# example (Debian / Ubuntu) sudo apt update && sudo apt upgrade php8.3 sudo systemctl restart php8.3-fpm
3. Interim measure if you can't update yet
Disable session upload progress, and on PHP 8.5 disable fatal-error backtraces, then restart all workers:
; php.ini session.upload_progress.enabled = 0 fatal_error_backtraces = 0 ; PHP 8.5 only
4. Retire end-of-life versions
PHP 8.1 and older will not receive an official fix; plan an upgrade to a supported branch.
5. Defense in depth
Run PHP with least privilege, enable a web application firewall (WAF) with virtual patching, and watch workers and logs for repeated crashes or anomalous behaviour.
05 — Reliant
How Reliant helps
We quickly determine whether your systems are exposed to php2shell — across your servers, applications and environments — and give you a clear report of what to patch and in what order, then re-test to confirm the gap is closed.
- A fast exposure check for CVE-2026-109618 and CVE-2026-109619 across your assets.
- A review of PHP versions, runtimes and configuration.
- Penetration testing for web applications and APIs.
- An actionable report with remediation steps and a verification re-test.