PHP2Shell: Two Critical PHP Flaws Patched, Exploit Attempts Seen

BENGALURU: PHP released emergency security updates on October 21, 2026 for two critical flaws in the language itself, tracked as CVE-2026-109618 and CVE-2026-109619, that could let an attacker without an account run code on a web server.^[4][2] Both are rated 9.2 on the CVSS v4.0 scale. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.^[4][3] The PHP team says there is no complete mitigation, so updating is the only safe choice.^[2][3]

Which Versions Are Fixed

Source: PHP release notes and reports by The Hacker News and Laravel Forge.^[2][3][4][6]

PHP 8.1 and older are end of life. PHP 8.2 reaches end of life on December 31, 2026.^[4] For older branches, the PHP security team published source backports for PHP 7.4, 8.0 and 8.1 to help people who build from source or wait on a vendor.^[4] Linux distributions received the patches in advance, so a packaged build can carry the fix under an old-looking version number. Check the package changelog for the CVE, as Debian advises, instead of the version string.^[4]

Who Is Affected

Every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, according to PHP's advisory as reported.^[4][7] The flaws sit in the runtime, not in any application, so a site is exposed even if its own code is secure.^[4] The researchers say they affect nearly every PHP version back to PHP 5.4.^[4]

PHP rates the risk highest on servers running Apache with mod_php, where an unauthenticated request can trigger the problem before application code runs.^[4][7] PHP-FPM behaves differently because it shuts a worker down when a request fails early in setup. PHP's analysis says no complete FPM exploit had been shown for one of the two flaws.^[4] The advisory also notes that an attacker may be able to read memory from the PHP worker process, which can hold passwords, authentication tokens, API keys and certificates from other requests.^[4]

For site owners on shared or managed hosting, the fix usually sits with the host and not with the site owner.^[7] Updating WordPress or Laravel does not update the PHP runtime beneath them. That update comes from the server package, the hosting provider or the container image.^[4][7]

How the Flaws Surfaced: A Timeline

The flaws were found by researchers at Wiz, Calif and OpenAI's Codex Security team, who worked with the PHP security team and Google's Gemini team on a fix.^[4] The PHP Foundation said a core developer saw early signs of the out-of-memory problem during PHP's 2024 external audit, but no route to code execution was found and work on a fix stalled for months.^[11] It called the delay a structural failure of its decision process and its resources. It said it has since changed how it makes security decisions and added staff and tooling.^[11]

The researchers say AI models helped turn the long-standing flaws into working exploits, letting one researcher do in about a week what they say would otherwise have taken a team months.^[4] Depth Grid's guide to the AI native company covers how AI is changing the way software and security teams work.

Is It Being Exploited?

Cloudflare said it saw early attacks before the patch shipped and that attackers changed their payloads to get around its firewall rules.^[4][12] watchTowr, which reproduced CVE-2026-109618, first reported no exploitation in the wild and then said at 14:19 UTC on October 21 that it was seeing active exploitation attempts of both flaws.^[4][13] No source reviewed had confirmed a successful break-in of a specific server. Neither flaw was in the CISA Known Exploited Vulnerabilities catalog at the time of the morning report.^[4]

Some organisations took services offline as a precaution. BambooHR took its service offline in the United States, Canada and Ireland and warned that payroll would be interrupted, according to The Hacker News.^[4] In the Netherlands, several government and education sites went offline.^[4][14]

What to Do Now

Source: PHP advisory and reports by The Hacker News and runZero.^[2][4][5]

If you cannot update immediately, PHP says only updating is a complete fix. The partial measures reduce exposure to specific attack paths without making a server safe.^[4] For one flaw, the guidance includes setting memory_limit to minus one in a way applications cannot override, keeping post_max_size low and enforcing request size limits at the web server or proxy. PHP warns against using RLIMIT_AS or RLIMIT_DATA as a substitute.^[4][5] For the other, it includes disabling session upload progress and restarting workers, with fatal error backtraces also turned off on PHP 8.5. This blocks only the confirmed paths.^[4][8]

Strategic Implications for Indian Businesses and Developers

PHP runs a large share of the web, including the content management systems, e-commerce plugins and payment pages that many Indian small businesses and agencies host on shared servers. For them the practical step is to ask the hosting provider whether the patched runtime is live and to confirm that PHP workers were restarted. Depth Grid did not find an advisory from CERT-In in the sources reviewed. Readers should follow its notices alongside vendor guidance.

For engineering teams, the episode shows how little time passes between disclosure and attack, how a broken embargo shortens the patch window and how end-of-life PHP versions leave sites without an official fix. Our report on how technology is rewiring banking and payments in 2026 covers the payment and banking systems that depend on web infrastructure.

Common Questions and Direct Answers

What are CVE-2026-109618 and CVE-2026-109619?

They are two critical flaws in the PHP core interpreter, each rated 9.2 on the CVSS v4.0 scale, that can let an unauthenticated attacker run code on a web server. One involves how PHP handles out-of-memory errors and the other involves global state that points to memory owned by a request. PHP released fixes on October 21, 2026.

Which PHP versions contain the fix?

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published on October 21, 2026. PHP 8.1 and older no longer receive official fixes, although the PHP security team published source backports for 7.4, 8.0 and 8.1. PHP 8.2 reaches end of life on December 31, 2026, so plan a move to a newer branch.

Is my WordPress or Laravel site affected?

Yes, if it runs on a vulnerable PHP version, because the flaws are in PHP itself and not in WordPress, Laravel or their plugins. Updating the application does not fix them. The PHP runtime must be updated through your hosting provider, server package or container image. Web workers must be restarted afterwards. Managed hosts are applying patches and some added interim protections.

Are the PHP vulnerabilities being exploited?

watchTowr reported at 14:19 UTC on October 21 that it was seeing active exploitation attempts. Cloudflare reported attack traffic and changing payloads. No source reviewed had confirmed a successful break-in of a specific server. Neither flaw was in the CISA Known Exploited Vulnerabilities catalog as of the morning report. Treat patching as urgent.

What can I do if I cannot update PHP immediately?

PHP says updating is the only complete fix. Partial measures include setting memory_limit to minus one so applications cannot override it, keeping post_max_size low. On affected setups they also include disabling session upload progress and restarting workers. These only narrow specific attack paths. Do not rely on them. Move to a fixed release as soon as possible.

Primary Sources and Regulatory Filings

1. PHP: 2026 news archive and security release announcement, October 21, 2026
2. php-src: PHP 8.5.12 release notes
3. php-src: PHP 8.4.27 release notes
4. The Hacker News: PHP issues emergency patches for two critical PHP2Shell RCE flaws
5. runZero: critical RCE vulnerability in PHP and how to find affected assets
6. Laravel Forge: PHP security advisory for CVE-2026-109618 and CVE-2026-109619
7. Codeable: PHP security release, what WordPress site owners need to do
8. InMotion Hosting: critical PHP security release and platform patch status
9. University of Washington IT: critical PHP vulnerabilities, October 2026
10. Phoenix Security: PHP core RCE flaws and the embargo leak
11. PHP Foundation: today's PHP security release and how we are strengthening PHP security
12. Cloudflare: PHP vulnerabilities and WAF protection
13. watchTowr: PHP CVE-2026-109618 FAQ
14. NOS: Dutch government and education websites offline over the PHP flaw

By Mahesh | Depth Grid News Desk | depthgrid.in