PHP has issued patches for two critical vulnerabilities, named PHP2Shell, which can yield unauthenticated remote code execution (RCE) on web servers running PHP. The flaws are tracked as CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), with a CVSS score of 9.2.
In practical terms, researchers demonstrated RCE on systems using Apache with mod_php, and the issues lie in memory management and error handling within PHP’s core, meaning a large portion of PHP deployments could be affected.
Patches were released across PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports for PHP 7.4, 8.0 and 8.1. Before the fixes arrived, PoC exploits circulated and exploitation attempts were observed in the wild. WatchTowr reported early in-the-wild hits to its sensors around the patch arrival, though no successful takeovers were observed at that stage; other organisations such as Patchstack, Cloudflare and Vega also noted exploitation attempts prior to or on the day of the disclosure.
The vulnerabilities affect nearly all PHP releases back to version 5.4 and can be used to read sensitive process memory containing credentials and keys. Organisations are advised to patch promptly or, where patching is not possible, apply mitigation measures to reduce exposure to specific attack paths while recognising that installations cannot be made fully safe.