The PHP project has released emergency security updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code on a vulnerable web server. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and widely called PHP2Shell, affect the PHP runtime rather than one specific website platform.
Administrators should update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the release branch their server uses. The PHP security team says temporary mitigations are incomplete and upgrading is the only safe choice. That makes this relevant to WordPress, Magento and custom PHP sites alike, even when their plugins and application code are fully updated.
What PHP2Shell can do
Both vulnerabilities can lead to remote code execution, one of the most serious outcomes in web security. In plain English, a specially crafted web request may cause a vulnerable PHP process to execute instructions chosen by an attacker. That could expose data, alter a site, install malicious files or provide a path deeper into the hosting environment.
The first bug, CVE-2026-109618, involves corruption during out-of-memory handling while PHP is processing request data. The second, CVE-2026-109619, involves request-related internal state remaining available after its backing memory has been released. A later request handled by the same worker may then use that stale state before initialization resets it.
The PHP team rates both vulnerabilities 9.2 under CVSS 4.0. Its advisory says every PHP installation serving web requests should be considered at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The demonstrated risk is highest for mod_php because an unauthenticated request can trigger the issue before application code runs.
Which PHP versions contain the fixes?
The corrected production releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older are no longer supported directly by the PHP project. Some Linux distributions and long-term-support vendors may provide backported patches, so the visible version number may not tell the whole story. Administrators using an older branch should consult their operating-system or hosting provider’s security notice rather than assuming a server is safe.
PHP 8.2 is also scheduled to reach end of life on December 31, 2026. The emergency release closes these two flaws, but sites remaining on 8.2 need a plan to move to a supported branch so they continue receiving future security fixes.
A follow-up advisory adds one more precaution
On October 23, the PHP project published an additional informational advisory concerning session upload progress. It recommends setting session.upload_progress.enabled=0 until the next regular bug-fix release for installations using an unusual combination of session configuration and application behavior.
The condition requires an application to use either the php_binary or php_serialize session handler in configuration, switch to the standard php handler at runtime, and then start a session while upload progress remains enabled. PHP describes this combination as unlikely, and sites that never change the serialization handler at runtime can keep the feature enabled.
This follow-up does not replace the emergency update. It is a separate precaution for a narrow path now tracked as CVE-2026-115560. Administrators who disable the feature should make the change in server-level PHP configuration and restart workers, following the hosting provider’s instructions.
AI helped find the vulnerabilities
OpenAI says security researcher Calif identified one of the critical flaws using GPT-5.6 Sol through its Patch the Planet initiative. Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the fixes and release, while OpenAI, Wiz, Cloudflare and other partners coordinated testing and protections before public disclosure.
This is an important distinction: AI did not patch unattended production systems or replace human review. Researchers used the model as part of a security workflow, verified the findings, reported them privately and coordinated with maintainers before technical details became public.
The same capability creates pressure on defenders. AI can search large codebases continuously and may help researchers find complex problems faster, but it can also shorten the time attackers need to study a newly disclosed bug. Reuters reported that security professionals expect more urgent patching events as AI-assisted vulnerability discovery expands.
Cloudflare added protection, but a WAF is not a patch
Cloudflare says it deployed protections for customers using its web application firewall before public disclosure. Those rules analyze both incoming requests and origin responses, helping identify exploit attempts while reducing false positives. Cloudflare also reported attack traffic and attempts to mutate payloads around the time of disclosure.
However, Cloudflare explicitly advises customers to patch PHP even when WAF protection is active. A firewall is a useful defense-in-depth layer, not proof that every attack path is blocked. Sites behind another CDN, a disabled WAF or a customized PHP configuration should not assume they received equivalent protection.
What website owners should do now
Owners of managed WordPress or ecommerce hosting should first check the hosting dashboard, support notice or managed-service status page. Many providers control the PHP runtime and may have installed a patched vendor package automatically. Confirm the running version or vendor patch status instead of changing server settings blindly.
Administrators who manage their own server should inventory every PHP runtime serving web traffic, install the package supplied by the operating-system vendor or PHP project, and restart the relevant PHP and web-server processes. Test critical functions such as sign-in, checkout, file uploads and scheduled tasks after updating. Review server and WAF logs for unusual requests, unexpected files or unexplained account changes.
Do not rely only on updating WordPress core, themes or plugins. Those updates are still important, but PHP2Shell exists below the application layer. A fully current WordPress installation can still run on an unpatched PHP runtime.
What users and small-site owners should know
Ordinary visitors do not need to install a PHP update on their phones or computers. The action belongs to the organization running the website. Consumers should remain cautious about unexpected password-reset messages and phishing emails that use the security news to create urgency.
For small-site owners who do not have server access, the safest step is to ask the host whether their PHP packages include the fixes for CVE-2026-109618 and CVE-2026-109619. Avoid installing unofficial “PHP2Shell cleanup” plugins or running commands copied from random posts. Server-level updates should come from the PHP project, the operating-system vendor or the hosting provider.
The practical message is simple: identify the PHP runtime, confirm that it contains the October 21 fixes, restart affected workers where required, and keep monitoring. The vulnerabilities are serious, but responsible disclosure gave defenders patched releases and infrastructure protections before the full public scramble began.