On October 21, 2026, PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities have a CVSS v4.0 score of 9.2 and can enable unauthenticated remote code execution in affected deployments. The exposure includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP identifies mod_php as the highest-risk configuration because an unauthenticated request can reach the vulnerable lifecycle before application code runs.

CVE-2026-109618 concerns memory handling during failed allocations. Complex multipart input, many headers inside parts, nested field names and other attacker-controlled allocations can push PHP into an out-of-memory path. Cleanup may then process request data that was never fully initialized. The confirmed impact is remote code execution under the web-worker account.

CVE-2026-109619 involves request state that survives longer than it should. A long-running worker can retain a pointer to memory released after an earlier request, creating a use-after-free condition for a later request. PHP confirmed paths involving fatal-error backtraces in PHP 8.5 and session upload progress. The wider problem covers more than one setting or extension.

The issue is in the PHP runtime, not necessarily in WordPress, Laravel, Magento or a plugin. A patched application can still run on a vulnerable PHP binary, and a request can reach the flaw through a small script, health check, login form or upload endpoint before normal framework logging begins. Cloudflare described the relevant failure modes as problems with memory, errors and request state during HTTP processing.

The fixed releases are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. PHP 8.1 and older no longer receive fixes from the PHP project. Operating-system and long-term-support vendors may backport patches, so the package changelog and vendor advisory matter more than the visible upstream version string.

The first signs of the out-of-memory problem appeared during an external audit in 2024, according to the PHP Foundation. A reliable route to code execution was demonstrated later by Calif, OpenAI and Wiz. The patches change out-of-memory handling and reset a broader set of request-owned global state. A delayed soft out-of-memory path and a safer hard termination path prevent shutdown from processing invalid state.

Updating files is not sufficient. Operators must identify the runtime and package source that serve each public application, apply a fixed package or container image, restart Apache, PHP-FPM, CGI workers, FrankenPHP, LiteSpeed and other long-lived PHP processes, then verify the running binary and package changelog. Health checks should cover uploads, sessions, queues and background jobs. Preserve pre-patch logs before normal rotation removes them.

PHP calls the fixed release the only complete mitigation. Before patching, conservative request-size limits and multipart bounds can reduce exposure. Removing predictable attacker-controlled memory_limit failures may help, but PHP warns against substituting RLIMIT_AS or RLIMIT_DATA because those limits can trigger the allocation-failure path. Administrators should disable session.upload_progress.enabled and restart workers. PHP 8.5 deployments should disable fatal_error_backtraces as well. These measures block confirmed paths, not every stale-state path.

Cloudflare reported WAF rules based on request and response signals, and AWS described blocking or detecting known attempts. Such controls provide defense in depth, but they do not replace a runtime update. If immediate patching is impossible, reduce reachability through a VPN, allowlist or authenticated edge, prevent direct origin access, disable unnecessary multipart uploads, remove unused secrets from the worker, restrict its operating-system and network privileges, and retain web, PHP, proxy, process and authentication logs.

Amazon Threat Intelligence reported an attempted PHP2Shell exploit against its MadPot honeypot on October 17, four days before public disclosure. Amazon later saw several proof-of-concept attempts from different anonymized infrastructure around the release. It could not establish whether the earlier attempt would have succeeded against a real target. Organizations should investigate from October 17, or from the earliest date recorded by their own threat-intelligence providers.

Hunting should include process telemetry, reverse-proxy and PHP error logs, endpoint detection data and file-integrity alerts. Relevant indicators include web workers launching shells or network tools, repeated memory-limit failures, HTTP 500 responses, crashes, unusual restarts, abnormal multipart requests, new files in web roots or temporary and startup paths, unexpected outbound connections, new credentials or scheduled tasks, and access to secrets, certificates or databases outside normal application behavior. A clean application log does not rule out runtime-level activity.

The response starts with an inventory of every internet-facing PHP service, including containers, virtual machines, shared hosting, control panels, appliances, old subdomains, staging systems and vendor-managed installations. Record the SAPI, package source, patch status, restart method and owner. Prioritize public mod_php and PHP-FPM systems, especially those accepting uploads. If suspicious execution appears, isolate the host, capture volatile evidence where possible, rotate exposed credentials and follow the incident-response process instead of deleting artifacts in place.

PHP2Shell demonstrates why worker processes need security controls of their own. Exploitation depends on the PHP build, SAPI, extensions, allocator, frontend configuration, worker reuse and request path, so not every server is automatically compromised. The risk is nevertheless independent of application patch status. Runtime packages, worker privileges, outbound access and process creation from web identities all need regular review.