PHP2Shell: critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Security advisory information last reviewed: 22 October 2026
The PHP project released emergency fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 for two critical issues: CVE-2026-109618 (remote code execution via out-of-memory corruption) and CVE-2026-109619 (remote code execution via stale global state). The PHP project’s advance notice rated both at CVSS v4.0 9.2. Not every PHP website is vulnerable; sites already on those fixed releases—or on a vendor build that includes the fixes—are not described as still affected by these two issues.
CISA’s alert of 21 October 2026 stated that exploitation had not been observed as of publication. Later public reporting describes exploitation attempts after patches were announced. We do not publish exploit steps or weaponized procedures on this site.
There is no complete mitigation short of updating the runtime. Temporary configuration changes and web application firewalls may reduce specific paths; they do not replace the patch and do not guarantee protection. PHP 8.1 and older no longer receive updates from the PHP project unless a vendor backports fixes.
Mars Innovation Technology helps organizations verify exposure, plan patching, and test applications after runtime changes. Use the free consultation if you need engineering help interpreting these advisories for your hosting environment.
Security and DevSecOps scope inside this fixed-price package is delivered with Seya Group. For security and DevSecOps consulting, see their team directly.
The consultation is free. Paid work is scoped and invoiced only after you accept a proposal. This page does not take payment.