Two flaws in PHP 8.2 to 8.5 can lead to unauthenticated remote code execution. Here are the fixed versions and what to do now.
Two memory corruption flaws were found in the PHP versions that handle web requests. CISA and Wiz Research call the pair “php2shell”. CISA added both to its Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026. If PHP runs on your server, including PHP bundled inside other software, check it now.
Short answer: CVE-2026-109618 and CVE-2026-109619 are two PHP memory corruption flaws. According to NVD, both can allow remote code execution (RCE) without authentication. Their CVSS 4.0 scores are 9.2, critical. Updating to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 is the only complete fix. For PHP 8.1 and older, CISA recommends taking PHP-based systems offline until they are patched or updated.
What happened?
When PHP runs out of memory (OOM), it exits the current request with longjmp(). According to NVD, some contexts do not properly handle this case and leave the request memory uninitialized. The request cleanup then reads that memory or branches on it. The second flaw is similar in effect but comes from a different path. PHP has some global state that points into request memory. That state may not be reset correctly, or it may be filled again after the reset. The next requests can then read this stale state.
NVD classifies both flaws as CWE-416, which means use of memory after it has been freed. In plain terms, the program uses a memory area that is no longer valid, and that can open a path to uncontrolled code execution.
The flaws were published on October 21, 2026. Five days later, on October 26, CISA added both CVEs to the KEV catalog. CISA lists entries there when it has evidence of active exploitation, so attacks started within a week of disclosure.
CISA’s KEV entry adds an important detail: the Linux kernel flaw CVE-2026-46300 can be chained with these two PHP flaws to implant webshells and run commands as root. So while you patch PHP, check the Linux kernel flaw too.
Who is affected?
| Feature | Details |
|---|---|
| CVE IDs | CVE-2026-109618, CVE-2026-109619 |
| Product | PHP (PHP Group) |
| CVSS score and severity | 9.2, critical (CVSS 4.0) |
| Weakness type (CWE) | NVD: CWE-416. The KEV entry also lists CWE-755, CWE-824, CWE-1325, CWE-1419 |
| NVD publication date | October 21, 2026 |
| Added to CISA KEV | October 26, 2026 |
| CISA due date | October 29, 2026 |
| Affected versions | Below 8.2.35 for 8.2; below 8.3.36 for 8.3; below 8.4.27 for 8.4; below 8.5.12 for 8.5 |
| Fixed versions | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
| Known ransomware use | Unknown (KEV lists “Unknown”) |
| PHP 8.1 and older | No fixed version listed in the sources. CISA recommends taking systems offline |
The flaws are in PHP itself, not in application code. Wiz Research says even a simple “Hello World” application on an affected version can be vulnerable. CISA lists Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed as affected setups.
What should you do?
- Check the PHP version on the server with
php -v. The PHP used by your web server can differ from the one on the command line, so verify the version the web side actually runs. - If the version is below 8.2.35, 8.3.36, 8.4.27 or 8.5.12, update it. On shared hosting or a control panel, look for the PHP version setting in the panel or ask your provider.
- If PHP is bundled inside another application, include it in your inventory. CISA recommends this.
- If you run PHP 8.1 or older, take PHP-based systems offline until you can update. This is CISA’s recommendation.
- If you cannot update right away, apply these temporary measures. They are not a complete fix:
- The main configuration mitigation in PHP’s own advisory: set
memory_limit=-1, restart every PHP worker, and make sure no pool, directory or application setting brings a finite memory limit back. The advisory says this is not a complete fix. - Keep
post_max_sizeconservative and limit request size at the web server or WAF too. - If your application does not use multipart forms, block those requests at the front end.
- On PHP 8.5, set
fatal_error_backtraces=0andsession.upload_progress.enabled=0. Restart all PHP workers after the change. - Do not use
RLIMIT_ASorRLIMIT_DATA. The vendor notes these limits makemmap()fail and trigger the vulnerable path. - A WAF may offer some protection until you patch. CISA says it is not a substitute.
- The main configuration mitigation in PHP’s own advisory: set
- If you suspect compromise, review server logs. Unusual multipart requests followed by memory limit errors, or repeated HTTP 500 responses, are worth a look. Also check whether PHP worker processes started shells or downloaded tools. If you find signs of compromise, isolate the system, preserve logs and work with a security specialist.
Frequently asked questions
Am I affected?
Yes, if PHP runs on your server and its version is below the fixed releases above. Check both php -v and the version your web server actually uses.
My application has no security issues. Do I still need to update?
Yes. The flaw is in PHP’s core, not in your application code. Keeping your own code clean does not protect you from it.
What if I cannot update right away?
Apply the temporary measures above and schedule the update as soon as possible. They do not give full protection. On PHP 8.1 and older, CISA recommends taking the system offline until it is updated.
Sources
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109618
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109619
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA alert (October 21, 2026): https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- PHP security advisory: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- PHP security advisory: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- Wiz Research analysis: https://www.wiz.io/blog/php2shell-php-rce
This article was prepared on November 6, 2026, based on CISA and NVD records. It will be updated if new information appears. If you need help planning a PHP update or server maintenance, you can write to me through the quote form. For more background, see the PHP security checklist.