Two critical PHP bugs fixed on 21 October 2026, CVE-2026-109618 and CVE-2026-109619 (together called PHP2Shell), can be chained for unauthenticated code execution on a web server. AlmaLinux scores both 9.2 on CVSS v4.0, and an exploitation attempt was recorded on 17 October, before public disclosure. If you run PHP anywhere, this is a runtime upgrade, not an application update.
What is affected
- Any PHP serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed
- mod_php is the most exposed setup; remote code execution was also confirmed on PHP-FPM for CVE-2026-109619
- CVE-2026-109618: memory corruption when a request hits the per-request memory limit (a crafted multipart upload can trigger it)
- CVE-2026-109619: stale state surviving between requests on the same worker, leading to a use-after-free
- Updating WordPress, Drupal, Laravel or plugin code does nothing here
A practical patch flow
- Build an inventory: prod sites, staging boxes, admin panels, old microsites and vendor appliances that bundle PHP
- Record the exact PHP version on each host or image, and get it in writing from managed hosting providers
- Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distro's patched package (source backports exist for 7.4, 8.0 and 8.1)
- Restart PHP-FPM or the web server so workers load the new binary, then confirm the running version
If you cannot patch today
- Disable session upload progress
- Lower upload and memory size limits
- Remove per-directory settings that throw warnings
- Put updated WAF rules in front of the app
- For public systems that stay unpatched, follow FBI and UK NCSC advice and consider taking them offline
What to look for in logs
- PHP worker processes spawning command shells
- PHP processes downloading files
- Preserve logs before cleanup if anything looks off. In India, check whether the CERT-In six-hour incident reporting rule applies to you.
More detail: PHP2Shell patch guide for Indian website owners
Written by the team at Affix Center, an IT services company in Lower Parel, Mumbai.
Top comments (2)
the php situation is crazy at the moment
php runtimes everywhere, patching all of them is the actual job.