The PHP team released emergency security updates on October 21, 2026, for two vulnerabilities collectively named PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both allow remote code execution on a web server without logging in and without any user action. The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The flaws were found by researchers at Wiz, OpenAI and Calif. The bugs sit in the PHP engine itself: in session handling, the OPcache class cache, and building the stack trace on a fatal error. They are tied to how PHP behaves when it runs out of memory. Both are rated 9.2 on CVSS v4.0. The firm watchTowr assigned the maximum score of 10.0.
Versions starting from PHP 5.4.0 are considered affected, but not every release was tested separately. Because the flaw is in the core, stores running on Magento, Shopware and WooCommerce are also at risk, even if their own code is clean. Sansec confirmed unauthenticated remote code execution on Magento 2.4.9 and ten other PHP applications. According to the firm, public descriptions and an exploit tool are already available.
Attacks began before the patch came out. Amazon Threat Intelligence recorded an exploitation attempt on October 17, four days before disclosure. Cloudflare reported early attacks on October 21 at 07:43 UTC, while the release came out at 14:00 UTC. Some services were taken offline during the patching; Wikimedia's Phabricator, for example, was unavailable.
What remains unclear is the list of affected commercial products. Fortinet is checking 12 products, Cisco is checking 31 products and a cloud service, and no confirmed vulnerable products have been identified so far.
Those running landing pages, trackers, affiliate dashboards or white-label sites on PHP should check the PHP version on their hosting and in containers, and see whether the host or CMS has released its own updates. Sansec also describes temporary measures for those who cannot update immediately; they are listed in its analysis.
