PHP2Shell Vulnerabilities Trigger PHP Emergency Patches for CVE-2026-109618 and CVE-2026-109619

On October 20, 2026, the PHP security team announced an accelerated release of patches for two CVSS 9.2 vulnerabilities known collectively as PHP2Shell. The fixes arrived the following day at approximately 13:30 UTC, addressing CVE-2026-109618 and CVE-2026-109619 in the PHP core request handling and error paths.

Technical Details of PHP2Shell Vulnerabilities

CVE-2026-109618 arises during out-of-memory conditions in request setup, particularly with multipart/form-data parsing. The longjmp mechanism interrupts initialization, leaving internal structures in an inconsistent state that cleanup routines later treat as valid, enabling unauthenticated remote code execution.

CVE-2026-109619 stems from request-owned state persisting after its backing memory is freed. Subsequent requests on the same worker process can reuse the stale data through vectors such as session upload progress or fatal error backtraces, again resulting in remote code execution and memory disclosure.

Both issues affect the PHP engine itself and require no specific application code to trigger. Researchers observed scanning activity in honeypots as early as October 17 and public proof-of-concept exploits shortly after disclosure.

Affected Versions and Recommended Actions

The vulnerabilities impact every PHP release from 5.4 through the pre-patch branches: 8.2.x below 8.2.35, 8.3.x below 8.3.36, 8.4.x below 8.4.27, and 8.5.x below 8.5.12. Highest exposure exists for Apache mod_php deployments, though PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed configurations are also at risk.

PHP 8.1 and earlier reached end-of-life status and received only limited source backports. Administrators must obtain updated packages from Linux distributions, hosting providers, or control-panel vendors such as cPanel and CloudLinux. PHP 8.2 reaches end-of-life on December 31, 2026, prompting migration planning alongside the immediate patching requirement.

Official guidance from PHP, CISA, CERT-EU, and NCSC-UK states that no complete workarounds exist and that internet-facing systems should receive priority updates. Systems that cannot be patched should be isolated from external networks.

Response Timeline and Ongoing Monitoring

The coordinated disclosure schedule slipped when details surfaced publicly, leading PHP maintainers to ship the release one day earlier than originally planned. Coordinated statements from multiple national cybersecurity agencies emphasize rapid remediation over reliance on network controls or application-level filters.

Security teams continue to track exploitation attempts and the separate but related vector tracked as CVE-2026-115560. Organizations should verify patch deployment across all web servers and monitor vendor advisories for additional backported releases in the coming weeks.