PHP2Shell: Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619
This text was generated using artificial intelligence (AI).As of October 21, 2026, 4:30 PM CEST – Patches are available. The PHP project has released the security updates. Public exploits exist, with initial attacks already observed according to RUS-CERT of Stuttgart University. Those running PHP web servers should update now.
On October 21, 2026, the PHP project released versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 These address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 according to CVSS v4.0 CVE-2026-xxxx. Both allow unauthenticated remote code execution. Details about the vulnerabilities became public on October 20, 2026.
The BSI has issued an IT security advisory regarding the vulnerabilities with the Criticality 3 / Orange . This means according to the BSI scale: Actions must be taken immediately, a significant disruption of regular operations is possible.
According to the PHP advisory, all PHP installations processing web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP project estimates the highest risk with mod_php : There is a demonstrated exploit where a request triggers the attack without any login, even before application code runs.
PHP-FPM is also affected. For CVE-2026-109619, remote code execution has also been demonstrated against PHP-FPM, according to the GitHub advisory, via the session upload progress feature that is enabled by default. However, this method requires a suitable operation in the application. For CVE-2026-109618, the PHP project considers FPM vulnerable based on source code analysis, but has not demonstrated a complete FPM exploit for it; FrankenPHP is considered likely vulnerable. When exploited successfully, attackers execute code with the rights of the web worker account.
The two vulnerabilities in detail:
CVE-2026-109618 – Remote Code Execution via Out-of-Memory Error (GHSA-w8hw-w9fx-j79w): If PHP aborts a request due to lack of memory while internal request data is only partially initialized, the cleanup routine may treat this invalid data as valid. According to the advisory, the lack of memory can be deliberately triggered via crafted multipart requests.
CVE-2026-109619 – Remote Code Execution via Outdated Global State (GHSA-6wmf-4rv5-p3rp): State associated with a request can survive in the worker process after its memory has already been freed. A later request in the same worker can use this state before it is reset (Use-after-free).
The CVSS score indicates a high attack complexity. However, with public exploits, this hardly matters in practice.
How great the risk is
PHP runs on a large portion of web servers: under WordPress, Drupal, TYPO3, Joomla, Magento, Shopware, WooCommerce, and Nextcloud, as well as on shared hosting platforms and in control panels. The BSI also points out that PHP is used in components of proprietary products, including in the firewall distributions pfSense and OPNsense. The vulnerabilities are in PHP itself and must be addressed at the server infrastructure level; changes in application code are insufficient.
RUS-CERT at the University of Stuttgart reports that publicly available exploits exist. It has successfully verified one of them on a test system and reports that attacks on the internet have already been observed. The BSI deems widespread exploitation within hours of the patches being released to be likely, as patches can be quickly analyzed and translated into exploits using AI-supported tools.
What You Should Do Now
On PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 Update.
Those obtaining PHP through their Linux distribution's package management need the patched packages from their distribution. According to the PHP project, distributions and LTS providers have received the patches in advance; however, it may take some time for the packages to appear in all repositories according to RUS-CERT. Check the patch level with php -v or against the backport version of the distribution (advisories for Ubuntu, Debian, and Red Hat).
Those using the voluntarily maintained repository rpms.remirepo.net: According to the PHP project, there are currently no updates available there. The PHP project advises switching to distribution packages or building from source.
After the update, restart all PHP workers, such as PHP-FPM pools and Apache.
Don't forget PHP in Docker containers: Images need to be updated or rebuilt. For appliances with embedded PHP, new firmware versions from the manufacturers are required.
Contact the hosting provider if you do not operate the web server yourself, and request immediate implementation.
PHP 8.1 and older: The PHP project no longer provides updates for this. Minimal source code backports have been provided for PHP 7.4, 8.0, and 8.1. According to the BSI, all versions prior to 8.2 have reached their end of life, and PHP 8.2 will only receive security updates until the end of the year. Affected systems should be migrated to a supported version.
Where immediate updates are not possible, RUS-CERT and BSI recommend disconnecting affected systems from the internet or restricting their accessibility until the updates are installed.
Transitional measures when the update is not yet possible
The PHP project lists measures that make individual attack vectors more difficult. It emphasizes that only updating is a complete solution; RUS-CERT also warns that the measures can be circumvented and are insufficient for the operation of a publicly accessible PHP application.
Against CVE-2026-109618: memory_limit=-1 set it so that applications cannot overwrite the value (e.g., via php_admin_value in the FPM pool or in the Apache configuration), and post_max_size keep low (8M without file uploads, otherwise 32M). Additionally, set size and number limits for requests on the web server or proxy.
If the application does not need multipart forms, the PHP project recommends blocking such requests at the frontend before they reach PHP.
Against CVE-2026-109619: session.upload_progress.enabled=0 in the php.ini or set in the FPM pool and restart all workers; ini_set() and .user.ini are not enough. Under PHP 8.5 additionally fatal_error_backtraces=0. Those who do not need session upload progress should leave the feature disabled according to the PHP project even after the update.
If performance does not matter, the PHP project mentions pm.max_requests=1 as another option: Then each FPM worker only processes one request, and obsolete state cannot carry over to the next request.
Check error logs with error_reporting=E_ALL for warnings before script start, fatal errors, and „maximum execution time exceeded“ and fix any found errors. An unobtrusive log, according to the PHP project, is not proof that a system is secure.
DACH and EU Context
For entities within the scope of NIS-2: If an exploitation of these vulnerabilities leads to a significant security incident, the reporting obligations under Art. 23 of the NIS-2 directive apply, in Germany under § 32 BSIG. In Austria and Switzerland, the respective national reporting obligations apply. The BSI has issued a BSI IT security advisory (BITS-H 2026-297981-1032) with criticality orange regarding the vulnerabilities; this is freely distributable as TLP:CLEAR.
Identify exposed PHP systems
In the case of a remote code execution without authentication, it primarily depends on which systems are externally accessible. Web servers, subdomains, and other services under their own domains running PHP need to be checked. Forgotten legacy systems and separate web environments can easily slip through the cracks during a quick patch action.
How LocateRisk Addresses Exposed Assets
LocateRisk supports external attack surface management by providing visibility of externally reachable systems and deployed software. In this incident, it can help find publicly accessible web servers and PHP installations in the asset inventory and prioritize the update sequence.
LocateRisk does not replace patch management and makes no statements regarding whether a vulnerable PHP version is running on a detected system. For this, a comparison of the deployed version with the PHP advisory is necessary.
For outsourced web applications or customer portals, vendor risk management can additionally help document feedback from service providers regarding the patch status.
Am I affected?
This affects PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 as well as any older PHP version; the vulnerability is fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anyone who wants to know if PHP is even visible in their own externally accessible infrastructure can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
This affects all PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12, including the unsupported branches 8.1 and older. All installations that process web requests are at risk according to the PHP project, such as PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on October 21, 2026. Anyone using PHP from the Linux distribution needs the patched distribution packages. For PHP 7.4, 8.0, and 8.1, there are only minimal source code backports from the PHP project.
PHP2Shell is the name of an exploit tool, of which a screenshot emerged with the leak on October 20, 2026; the term is now used for both vulnerabilities. According to RUS-CERT, publicly available exploits now exist.
Isolate affected systems from the internet or restrict their accessibility until the update is installed. The transitional measures of the PHP project, such as session.upload_progress.enabled=0, complicate individual attack paths, but according to the PHP project do not make an installation safe.
Status: October 21, 2026. This article is for general informational purposes and is not a legal, security, or action advisory in individual cases. Security situation and patch availability may have changed since publication; the linked manufacturer advisory is always authoritative. Despite careful research, we assume no liability for the currentness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
A rough estimate in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-109618
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français