Security · October 24, 2026
PHP Issues Emergency Patches for Critical Remote Code Execution Flaws as Attacks Begin
The PHP project has released emergency updates to fix two critical security vulnerabilities in the PHP runtime that allow attackers without user accounts to execute code on web servers, while security firms watchTowr and Cloudflare report that attack attempts have already begun. These flaws, collectively referred to as PHP2Shell, affect nearly every version of PHP dating back to version 5.4, with patches now available in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619, both carrying a Common Vulnerability Scoring System version 4.0 score of 9.2. They were discovered by researchers from Wiz, Calif, and the Codex Security team at OpenAI. The danger stems from the issues residing within the PHP engine itself rather than in application code, meaning even securely written websites or simple pages are vulnerable. Every PHP installation serving web content is at risk, including those using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.
Systems utilizing Apache mod_php face the highest risk because a demonstrated exploit can execute with a single request without authentication and before any application code runs. For PHP-FPM, the behavior differs as the worker process terminates when a request fails early. Analysis indicates that while CVE-2026-109618 poses a risk to FPM, no complete exploit demonstration exists yet, whereas CVE-2026-109619 has been proven to execute code on both mod_php and PHP-FPM, though the FPM path requires specific conditions within the application. Additionally, attackers can read the memory of PHP worker processes without executing code first, potentially exposing authentication tokens, API keys, and certificates from other requests, a capability researchers have demonstrated against applications they do not control.
Administrators are urged to update their PHP runtime immediately and restart all relevant services including Apache, PHP-FPM, and persistent PHP workers. Updating applications like WordPress or Laravel does not update the PHP runtime, as the runtime comes from server packages, hosting providers, or container images. For PHP 8.1 and older versions no longer supported by the PHP project, the security team has published source code backports for versions 7.4, 8.0, and 8.1. PHP 8.2 will reach end of support on December 31, 2026. Linux distributions and vendors providing long-term support received patches in advance, so their packages may be fixed despite showing older version numbers; users should check changelogs for the specific vulnerability identifiers instead of relying on version numbers.
Following the update, administrators should review memory_limit and post_max_size settings to suit their applications, as the patch introduces a new hard memory limit that stops processes immediately upon reaching the threshold, preventing shutdown handlers from running. The PHP team emphasizes that updating is the only complete fix, as temporary measures only mitigate certain attack paths. For CVE-2026-109618, setting memory_limit to negative one prevents applications from overriding it, while keeping post_max_size low and limiting request sizes at the web server or proxy level is advised; using RLIMIT_AS or RLIMIT_DATA is discouraged as it may trigger the same vulnerability path. For CVE-2026-109619, setting session.upload_progress.enabled to zero and restarting all workers is required, and on PHP 8.5, setting fatal_error_backtraces to zero provides additional protection, though this only blocks the session-based path and not other attack forms.
Regarding the threat landscape, watchTowr reports observing attack attempts for both vulnerabilities, and Cloudflare notes that attackers are modifying payloads to evade its web application firewall rules, although no confirmed successful breaches have been reported yet. Researchers recommend monitoring for abnormal multipart requests followed by repeated memory limit errors or HTTP 500 status codes, unusually large PHPSESSID cookies, and unexplained PHP worker restarts.