PHP2Shell: Two Critical PHP RCE Bugs and How to Patch Today

This article was written on October 21, 2026, the same day the patches shipped. The situation is still changing, so check the details against PHP's official advisory.

On October 20, details of two critical remote code execution vulnerabilities in PHP leaked before the coordinated disclosure. The patches followed on October 21. They are being called PHP2Shell, and they are CVE-2026-109618 and CVE-2026-109619.

If you run PHP in production, this goes to the top of today's list. If you only write Python, keep reading: the last section covers what to check on your side.

What happened

According to Tenable's analysis, both flaws have a CVSS v4.0 score of 9.2 and allow unauthenticated remote code execution:

• CVE-2026-109618: a problem in how PHP handles out-of-memory (OOM) errors. An interrupted request leaves data partially initialized.
• CVE-2026-109619: PHP keeps request-specific state after the memory backing it has been freed (a use-after-free).

The reach is what makes this serious. It affects the SAPIs that serve web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php is the highest risk, because there is an exploit that triggers the attack with a single unauthenticated request before any of your application code runs. It doesn't matter whether your WordPress, your Laravel app or your custom code is well written.

According to Tenable, Calif says it confirmed pre-authentication RCE against specific versions of WordPress, Drupal, Joomla and Magento. Cloudflare reports early attacks and watchTowr says it is already seeing exploitation attempts. Public exploit code is circulating, but Tenable itself could not verify that it works, and the PHP Foundation said it did not identify any functional exploits at release time. My recommendation is to assume it works.

Fixed versions

Branches 7.4, 8.0 and 8.1 no longer have official support, but the PHP security team published minimal source backports. Linux distributions and LTS vendors received the patches before the public release, so the most practical step is to check your vendor's advisory.

Branches 5.4 through 7.3 have no fix at all. Calif says the oldest affected code path it found goes back to PHP 5.4.0. If you are still there, you have a bigger problem than this CVE.

What to do, in order

1. Find out which version you actually run. php -v on the host is not enough: in containers and on servers with several versions, the SAPI serving traffic may be a different one.
2. Update. It is the only complete fix. Prioritize servers using mod_php, then every other SAPI exposed to the internet.
3. Use your distribution's packages if you relied on volunteer-maintained repositories. The rpms.remirepo.net repository announced it will have no updates on publication day, according to Help Net Security.
4. Restart your PHP workers after any configuration or version change.

If you can't patch today

Tenable lists partial mitigations. None of them replaces the update:

• For CVE-2026-109618: set memory_limit=-1 in a way applications cannot override.
• For CVE-2026-109619: session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0.
• A container or cgroup memory limit helps as an availability boundary, but it is not a complete mitigation.
• Cloudflare deployed WAF rules for the known vectors, including on the free plan. They only cover traffic routed through Cloudflare, and the company itself calls them a stopgap.
• The UK NCSC suggests considering taking systems offline if you can't fix them. CERT-EU recommends isolating internet-facing applications until the fix is applied and verified.

And if you're a Python developer

I mostly write Python, and the temptation is to say "this doesn't affect me". It's not that simple.

CPython is also a runtime written in C, and it also ships security fixes. Today python.org's downloads page lists 3.15.1, 3.14.9 and 3.13.17, all released on October 21, plus 3.12.15 from September 30. I couldn't find security notes specific to those releases, so I'm not claiming they fix anything in particular. What that page does carry is a security notice: the emSign root CA was removed from certifi, and it asks you to upgrade certifi, pip, uv and sigstore.

The useful takeaway isn't counting who has more CVEs. It's auditing your own surface:

• Which Python version runs in your base image, and when did you last update it?
• Does your server depend on an outdated certifi or pip inside an old container?
• Do you have a process to learn about a patch the day it ships, or do you find out on social media?

If you want to put the last point in order, here is how to manage Python dependencies (in Spanish) so that updating is routine and not an emergency. There is also a Spanish version of this article.

Summary

• PHP2Shell is two critical RCE bugs (CVSS 9.2) affecting any PHP that serves web requests.
• Fix with 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or with your vendor's backport if you are on 7.4 through 8.1.
• mod_php first. Restart your workers.
• Several security firms report exploitation attempts, although verification of the public exploit is not unanimous.
• This story moves fast: check PHP's official advisory before making decisions.

Sources: Tenable, Help Net Security, Qualys, watchTowr, python.org.