PHP has issued emergency patches for two critical PHP2Shell remote code execution flaws that allow an attacker to run code on a web server without an account. The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team cautions that only updating to the fixed releases fully protects a server.
The two flaws reside in the PHP runtime itself, meaning a site can be exposed even if its own code is secure, with mod_php deployments posing the highest risk due to an unauthenticated exploit that can trigger before any application code runs. CVSS v4.0 scores are 9.2 for both issues, identified as CVE-2026-109618 and CVE-2026-109619. Disclosure followed an advance leak; PHP released the patches at 14:00 UTC on 21 October 2026.
Affected environments include any PHP installation serving web requests, such as PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The flaws enable reading memory from the PHP worker process, potentially exposing passwords, tokens, API keys and certificates from other requests, even without direct code execution.
Evidence of exploitation in the wild was limited before the patch; Cloudflare reported early attack attempts, while watchdogs such as watchTowr found no confirmed exploitation as of 11:26 UTC on 21 October 2026. In the interim, administrators were advised to patch promptly; where update is not possible, the advisory offers partial mitigations, but notes these are not complete fixes.
After patching, administrators should review memory settings, as the fix introduces a higher memory cap and may cause processes to terminate when reached.