If you run PHP on any server that touches the internet, this is a stop-and-patch alert. On October 21, PHP shipped emergency releases to fix two critical, memory-safety flaws – CVE-2026-109618 and CVE-2026-109619, together nicknamed “php2shell” – that let an unauthenticated attacker execute code on an affected host with nothing more than a single crafted web request. No login, and no vulnerability in your application code. The bugs live in PHP itself, the language that powers roughly seven out of every ten websites on the planet, including WordPress, Drupal, Joomla, and MediaWiki. If you run PHP 5.4 through 8.5, you are in scope.
Why this one is different. Most CVEs you patch because a specific plugin or CMS had a bug. php2shell is not that. The vulnerable code is in PHP’s core engine, so it affects every application running on top of it – even a trivial “Hello World” page. Wiz Research demonstrated pre-authentication remote code execution against the latest container images of WordPress, Drupal, and Joomla, and separately showed a memory-disclosure path that can leak passwords, authentication tokens, API keys, and certificates straight out of the PHP worker process’s memory. That last part matters: even where an attacker can’t land the full code-execution chain, the disclosure bug lets them read process memory. For a webserver that has handled admin logins, that often means stolen sessions and credentials.
What the vulnerabilities are. Both are rated critical by the PHP security team (CVSS v4.0 9.2), and the flawed code has been sitting in PHP since at least version 5.4 – more than a decade.
CVE-2026-109618 is a use-after-free in PHP’s out-of-memory error handling and upload-progress unserializer. The attacker sends a single oversized request that forces an allocation failure while PHP is still setting the request up. The request is interrupted and its data only partially initialized; during cleanup that half-built state is treated as valid. On a later request handled by the same worker, PHP consumes attacker-reclaimed memory as live bookkeeping – a memory-corruption primitive the researchers chained into full remote code execution. On mod_php this happens during request initialization, before any application code runs.
CVE-2026-109619 is a second RCE flaw caused by PHP retaining request-specific state after its backing memory has been freed. When the same worker later processes another request, PHP may access that stale state before normal initialization resets it. That gives an attacker an unauthenticated heap use-after-free, memory disclosure, and – in the chained proof-of-concept – code execution as the web worker account.
The AI angle. This is the part most people will remember about php2shell: the flaws were found and weaponized with the help of frontier AI models. Wiz Research credits Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol with turning a decade-old latent defect into a working pre-auth exploit in roughly a week – work a well-funded team would previously have needed months to complete. The takeaway is uncomfortable: memory-safety complexity is no longer a meaningful barrier to exploitation. If you have been betting that “this bug is too hard to exploit,” that math just changed.
Patch status. Details of the two CVEs leaked on October 20, ahead of coordinated disclosure. PHP pulled the release date forward and shipped fixes the next day, October 21, in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA issued an urgent notice telling organizations to patch immediately, and early reporting shows attacks already emerging in the wild. This is not a wait-and-see situation.
What you should do right now.
Inventory every PHP install – including the ones you forgot. Your application server is not the only place PHP runs. Check containers, base images, CMS stacks, vendor appliances, and anything using mod_php or php-fpm. WordPress, Drupal, Joomla, and MediaWiki images are affected, not just your custom code.
Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Test the upgrade against your applications, then roll it out. This is the only real fix; it eliminates the root cause and all known variants of the bugs.
Stop exposing end-of-life PHP to the internet. Any PHP version older than the supported 8.x branches should be treated as compromised the moment it is reachable. Isolate it, or decommission it.
If you cannot patch immediately, use the mitigations shipped by your WAF or CDN – Cloudflare, AWS, Akamai, and others released out-of-the-box protection rules for php2shell. These reduce exposure but are short-term cover, not a substitute for patching.
Hunt for signs of compromise. The typical fingerprint of this class of exploit is suspicious child processes spawned by the PHP process. Look for webshells, unexpected processes, and unusual outbound connections. Florian Roth’s free process-watcher tool is built to catch exactly this pattern.
Rotate credentials if you suspect memory disclosure. Tokens, API keys, and passwords that have passed through an affected worker should be assumed burned and replaced.
Bottom line: this is a “update everything that runs PHP, today” event. The vulnerabilities are real, the exploit path is proven and pre-authentication, and AI-assisted development means public exploit code is likely to follow quickly. Treat unpatched PHP as a liability.