PHP is preparing an emergency security release to fix two remote code execution flaws rated CVSS v4.0 9.2, with details pending in the official advisory. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed php2shell by researchers, are described as two heap use-after-free primitives in PHP’s session.upload_progress handler (php_session_rfc1867_callback, ext/session/session.c).
The PHP security team has not yet published the technical details, affected versions, or the fixed releases, but cautions that all PHP users should be ready to upgrade as soon as the update is available. The advance notice stated the fixes would be released on 21 October 2026 at 14:00 UTC, and that PHP reserves the right to move the release earlier if details go public or active exploitation is observed.
The article notes uncertainty around the scope and which components are affected, with early reports suggesting potential impact from PHP 5 onward, though official verification is pending. Community analyses cite a wide exposure risk and warn administrators to identify PHP deployments and prepare for upgrades once fixed versions are announced. Predicted patch versions circulating online included PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, though these are not confirmed by PHP at the time of writing.
Researchers also indicate that older, end-of-life PHP installations may not receive upstream fixes, prompting guidance to isolate or backstop such systems, or to back them behind VPNs, IP allowlists, or web application firewalls while remediation is prepared. CERT-EU similarly urges isolating internet-facing PHP applications where immediate patching isn’t feasible.