Two critical remote code execution flaws affecting core PHP runtime environments have been disclosed under CVE-2026-109618 and CVE-2026-109619. These flaws represent the remote code execution component of a broader group of core PHP vulnerabilities named PHP2Shell by cloud security research firm Wiz. According to Wiz, PHP2Shell encompasses multiple critical flaws—ranging from Heartbleed-style memory disclosure to unauthenticated remote code execution—affecting every PHP version released over the past decade back to PHP 5.4, and impacting web servers that power 70% of all websites in the world. System administrators must audit and upgrade exposed web workers immediately, while everyday internet users should take basic precautions when interacting with online services.

This analysis examines the root cause of both memory corruption flaws, details affected PHP branches and their official updates, explains practical steps for everyday internet users, and outlines a concise remediation guide for server operators.

What happened: The php2shell vulnerability pair

The security advisory published by the National Vulnerability Database (NVD) on October 21, 2026, identifies two severe flaws situated within the memory allocator and request execution lifecycle of the Zend Engine, the core runtime engine powering PHP.

When an unexpected error or an out-of-memory (OOM) condition occurs during an active web request, the runtime relies on internal longjmp constructs to halt execution and unwind the active stack. In unpatched releases, this abrupt interruption disrupts internal memory management structures, producing two dangerous failure modes:

  1. Uninitialized memory reuse (CVE-2026-109618): When memory allocation fails mid-request, memory pools designated for request variables are left uninitialized. Subsequent cleanup routines in the persistent worker process read or branch on this uninitialized memory, leading to heap corruption and remote code execution.
  2. Stale global state referencing (CVE-2026-109619): Internal global state pointers that temporarily reference per-request heap allocations fail to reset cleanly upon an abnormal exit. When the same worker handles a subsequent request, it interacts with stale memory pointers that have already been freed, allowing remote attackers to manipulate application control flow.

Because persistent PHP workers (such as those managed by PHP-FPM or persistent application containers) process hundreds of successive requests before cycling, unauthenticated external actors can send crafted HTTP payloads to trigger memory exhaustion, corrupt worker state, and gain arbitrary command execution on the underlying operating system.

Affected PHP versions and official patches

The PHP development team issued official bug fixes across all maintained branches on October 22, 2026. Every organization operating internet-facing services should audit their server fleet against the official version matrix below:

Branch Vulnerable versions Fixed release Support status
PHP 8.5 8.5.0 to 8.5.11 8.5.12 Active support
PHP 8.4 8.4.0 to 8.4.26 8.4.27 Active support
PHP 8.3 8.3.0 to 8.3.35 8.3.36 Security fixes only
PHP 8.2 8.2.0 to 8.2.34 8.2.35 Security fixes only (ends Dec 31, 2026)
PHP 8.1 and earlier All versions None End of Life (upgrade required)

According to the official PHP Supported Versions documentation, branches marked as Active support (PHP 8.4 and PHP 8.5) receive regular bug fixes alongside security patches. Branches designated as Security fixes only (PHP 8.2 and PHP 8.3) receive critical security updates exclusively; notably, PHP 8.2 reaches its final End of Life on December 31, 2026.

All legacy installations running PHP 8.1 or earlier remain permanently vulnerable to these flaws because discontinued branches no longer receive security backports. Organizations running legacy environments must plan immediate migrations to modern supported releases.

What this means for you

According to data compiled by Wiz, PHP powers 70% of all websites in the world, including popular content management platforms, e-commerce storefronts, and customer portals. Even if you do not manage servers yourself, the websites and digital services you use daily may depend on PHP.

While individual visitors cannot patch remote web servers directly, everyday users should keep the following practical precautions in mind:

  • Expect security notifications from online services: If an online platform, e-commerce merchant, or service provider informs you of a recent security incident or database breach, treat the notice seriously. Change your password for that service immediately.
  • Never reuse account passwords: Reusing the same password across multiple websites creates severe secondary risks. If an attacker compromises a vulnerable web server and harvests stored credentials, they routinely attempt credential stuffing attacks against banking, email, and social media platforms. Use unique, complex passwords for every digital identity.
  • Enable multi-factor authentication (2FA): Turn on two-factor authentication on every account that supports it, preferably utilizing an authenticator application or physical security key rather than SMS codes. Even if an attacker steals your login password from an exploited web host, 2FA prevents unauthorized account takeovers.
  • Beware of deceptive update prompts: Attackers who compromise web servers frequently inject malicious scripts into website templates. These scripts display convincing fake alerts claiming your web browser or video player is out of date. Never install browser extensions or software updates prompted by random websites; always update applications exclusively through official operating system app stores or built-in browser settings.
  • Protect network transit: On public Wi-Fi, a VPN encrypts the traffic between your device and the VPN server, so others on the same network cannot read it. Get VPNRice.

Action checklist for server administrators

If you manage web hosting infrastructure, staging clusters, or internal developer machines, apply the following remediation measures immediately:

1. Upgrade packages and verify distribution security advisories

If you rely on your Linux distribution's official package repositories (such as Debian or Ubuntu), package maintainers backport security patches directly into existing stable package releases without incrementing the upstream minor version number. Consequently, your installed PHP version string may continue to display as an earlier release (such as 8.2.26 or 8.4.15) even after the security fixes have been successfully applied.

First, update your local package indexes and upgrade your active PHP packages (package names below are illustrative examples; adjust the version string to match the PHP version provided by your repository):

sudo apt-get update
sudo apt-get --only-upgrade install php8.4-fpm php8.4-cli php8.4-common

Next, verify your installed package release version against the official security advisory published by your distribution (such as a Debian Security Advisory DSA or Ubuntu Security Notice USN):

apt-cache policy php8.4-fpm

Check the package changelog to confirm the inclusion of the security patches:

apt-get changelog php8.4-fpm | head -n 20

Only when you compile binaries directly from upstream php.net source archives, use third-party repositories such as Ondřej Surý's PPA, or run official PHP Docker container images will the command-line output from php -v directly match the upstream release numbers 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

2. Rebuild container images

Host system package updates do not modify packaged container images. If you run containerized applications in Docker or Kubernetes, update your base Dockerfiles to specify the latest patched minor release:

FROM php:8.4.27-fpm-alpine

Rebuild images with the --no-cache parameter to guarantee that vulnerable cached layers are purged:

docker build --no-cache -t web-app:latest .

3. Apply edge mitigations

Until all application servers are updated, configure edge firewalls or reverse proxies to inspect incoming HTTP requests. Enforce reasonable request header limits, throttle rapid multipart file uploads, and terminate abnormal connections before they reach backend worker pools.

Timely software updates and vigilant credential management remain the most effective defenses against critical web vulnerabilities.