If you run anything on PHP, stop what you're doing and check your version. A pair of critical memory-handling flaws — dubbed PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619 — allow unauthenticated remote code execution, carry a CVSS score of 9.2, and were already being actively exploited within days of disclosure.
The essentials
- Disclosed and patched: October 21, 2026.
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you're on anything older than these branches, you're exposed.
- Impact: unauthenticated RCE — an attacker needs no login, just a vulnerable server.
- In the wild: active exploitation was reported by October 23, with some compromised sites taken offline.
What to do
- Patch immediately to the fixed release in your branch. This is not a "next maintenance window" bug.
- Check for compromise — review access logs and look for unexpected processes or files around the disclosure window.
- Don't stop at PHP itself — make sure your distro packages, containers, and build images actually picked up the fixed version.
Memory-safety bugs in a language that powers a huge share of the web are the nightmare scenario precisely because the blast radius is so wide. PHP2Shell is a reminder that even mature, battle-tested runtimes need aggressive patch hygiene.
I covered the timeline, the affected versions, and mitigation steps in detail at Rohan Tech Official: PHP2Shell: The Critical PHP Flaw Putting Websites at Risk.
Adapted from the original — the full security breakdown is at the link above.
Top comments (0)