PHP2Shell: Two Critical PHP RCE Flaws Just Forced the Web to Patch Fast

CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities in the PHP core runtime. Both can allow an unauthenticated attacker to achieve remote code execution (RCE), and both received a CVSS v4.0 severity score of 9.2 / 10.

If you run PHP in production whether with Laravel, Symfony, WordPress, Magento, TYPO3, Drupal, or a custom application, this is not a framework problem you can ignore. It is a runtime problem.

TL;DR

• Two critical PHP vulnerabilities were disclosed on October 21, 2026.
• They can lead to unauthenticated remote code execution.
• Affected PHP versions range from 5.4 to 8.5.11.
• Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• PHP 8.1 and earlier are end-of-life and do not receive fixes.
• Update the PHP runtime, rebuild containers, and isolate unpatched public-facing systems.

Why this matters

PHP is still everywhere.

According to W3Techs, PHP powers about 64.5% of websites with a known server-side programming language among the top one million sites.

That includes WordPress, Drupal, Joomla, Magento, TYPO3, enterprise applications, internal tools, e-commerce platforms, and public-sector systems. A vulnerability in PHP itself therefore has a much larger blast radius than a vulnerability in one framework, CMS, or plugin.

How the vulnerabilities work

The issues involve memory corruption during PHP request processing.

CVE-2026-109618

An out-of-memory condition can interrupt PHP while request data is only partially initialized. During cleanup, PHP may treat invalid data as valid.

CVE-2026-109619

Internal request state can survive after its backing memory has been freed. A later request handled by the same worker may reuse that stale state before it is properly reset.

In both cases, a crafted HTTP request may trigger memory corruption and potentially allow arbitrary code execution on the server.

Are Laravel, Symfony, WordPress, and other PHP platforms affected?

Yes, if they run on a vulnerable PHP version.

This is not only a Laravel or Symfony issue. Any platform, application, plugin, theme, or third-party product running on an unpatched PHP runtime can be exposed.

That includes:

• Laravel applications
• Symfony applications
• WordPress sites, themes, and plugins
• Drupal and Joomla websites
• Magento, Adobe Commerce, and PrestaShop e-commerce platforms
• TYPO3 and other enterprise CMS platforms
• Custom PHP applications
• Legacy internal business tools
• PHP bundled inside hosting panels, Docker images, and third-party software

A modern Laravel or Symfony application can still be vulnerable if the underlying PHP interpreter is not updated. The same applies to a WordPress site, a Magento store, or a TYPO3 installation.

Frameworks and CMS platforms provide useful security features, but they do not control the PHP runtime itself.

Security is layered:

You need to secure every layer.

For example:

• A WordPress site may be exposed even if WordPress core is updated, if the hosting environment still runs PHP 8.1 or an unpatched PHP 8.2–8.5 version.
• A Magento store may need coordinated updates across the application, extensions, infrastructure provider, and PHP runtime.
• A TYPO3 project may be secure at the application level but still vulnerable if its Docker image or server uses an outdated PHP base image.
• A Laravel or Symfony application must be redeployed after its PHP base image is rebuilt.

The key question is therefore not:

“Am I using Laravel or WordPress?”

It is:

“Which PHP runtime is actually serving my application in production?”

Who is exposed?

Any internet-facing service running a vulnerable PHP runtime is potentially exposed.

This includes applications using:

• mod_php under Apache
• PHP-FPM
• PHP-CGI
• FrankenPHP
• LiteSpeed
• PHP bundled inside third-party products, hosting panels, CMSs, or container images

The AI angle

AI-assisted security research contributed to this discovery.

Wiz used a combination of models during research and remediation. Google stated that Gemini 4 Argon contributed to vulnerability discovery, exploit development, attack detection, and patch validation.

Public reporting also indicates that Calif identified one vulnerability using OpenAI’s GPT-5.6 Sol, while Wiz independently discovered and reported both flaws.

The accurate takeaway is not “AI found PHP’s vulnerabilities.” It is:

AI-assisted research is becoming a serious tool for finding subtle memory-corruption bugs that manual review can easily miss.

What should you do today?

1. Find every PHP runtime in production, staging, CI/CD, Docker images, servers, and third-party products.
2. Upgrade to a patched version: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
3. Rebuild and redeploy Docker images. Changing the Dockerfile is not enough if the deployed image is still vulnerable.
4. Prioritize internet-facing applications, especially legacy CMSs, e-commerce stores, and systems running unsupported PHP versions.
5. Isolate unpatched exposed systems from the public internet until they can be fixed.
6. Audit third-party software, because PHP can be bundled invisibly inside a product.
7. Stop using end-of-life PHP versions for new production workloads.

PHP is not dead

This incident does not prove that PHP is dying. It proves that PHP remains a foundational part of the web.

Modern PHP is very different from the PHP of the 2000s. PHP 8 brought major performance improvements, stricter typing, better object-oriented features, and a strong ecosystem around Laravel, Symfony, WordPress, Magento, TYPO3, and many other platforms.

But maturity does not remove the need for operational discipline:

• Patch the runtime.
• Rebuild containers.
• Track dependencies.
• Remove end-of-life versions.
• Reduce the exposure of legacy systems.

Final thought

A secure codebase is not enough if the runtime underneath it is vulnerable.

Whether you maintain a Laravel API, a Symfony enterprise application, a WordPress site, a Magento store, or a TYPO3 project, the same rule applies:

Patch first. Verify deployment. Avoid panic.