PHP Releases Emergency Patches for Critical Remote Code Execution Flaws

PHP released emergency security updates on October 21, 2026, at 14:00 UTC to address two critical remote code execution vulnerabilities in the language's core engine. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are rated 9.2 on the CVSS v4.0 scale and affect nearly all PHP versions from 5.4 onward. An unauthenticated attacker can exploit these flaws by sending specially crafted HTTP requests to trigger unsafe memory handling and error processing, potentially allowing arbitrary code execution, denial of service, or exposure of sensitive data such as passwords, authentication tokens, and API keys stored in worker memory.

The patches were released one day ahead of schedule following the premature disclosure of vulnerability details on October 20. A post on Hacker News initially claimed two CVSS 10.0 flaws would be disclosed on October 22, triggering an information leak within hours. The security firm watchTowr publicly confirmed the vulnerabilities were real and under embargo, prompting PHP to accelerate its release timeline. Researchers from Wiz, Calif, OpenAI, and Quarkslab identified the flaws. The exploits were demonstrated in a tool dubbed PHP2Shell, which videos showed executing code on popular platforms including WordPress, Drupal, Laravel, Magento, and Joomla.

Fixed versions are available only for supported PHP branches: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier versions have reached end of life and receive no official patches. According to security firm Mallory, approximately 59 percent of roughly 1.5 million internet-facing PHP installations run unsupported versions without patches available—an estimated 884,000 hosts. This includes approximately 368,000 systems on PHP 5.x, 329,000 on PHP 7.x, and 185,000 on PHP 8.0–8.1. Older systems cannot receive vendor patches, though some Linux distributions and third-party vendors may provide backports. Cloudflare reported deploying WAF protections before public disclosure and observing attack traffic attempting to exploit the vulnerabilities. Security experts and government agencies, including the UK's NCSC and Germany's BSI, urged immediate patching, warning that mass exploitation could occur within minutes to hours of patch availability using AI-assisted attack tools.

Memory-handling issues underlying both flaws were partially rooted in a problem identified during PHP's first external security audit in 2024, conducted by Quarkslab with funding from the Sovereign Tech Agency. A PHP core developer discovered signs of an out-of-memory (OOM) condition while fixing issues from that audit, but no concrete remote code execution vector was identified until researchers at Calif and OpenAI found exploitation paths in 2026. The PHP Foundation acknowledged delays in fixing the OOM problem stemmed from structural challenges in its security team's decision-making process and resource constraints, but said processes have since been reformed.