PHP has released security updates for two critical vulnerabilities that could allow attackers to execute malicious code on vulnerable web servers without authentication.
The flaws, known as PHP2Shell, affect PHP’s core runtime, which powers many websites and web applications.
Announced on October 21, 2026, the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both have a CVSS v4.0 severity score of 9.2 out of 10.
European cybersecurity agencies have urged organizations to apply the fixes immediately.
What Are the PHP2Shell Vulnerabilities?
The two flaws involve how PHP handles memory during request processing. Successful exploitation could allow attackers to run code on affected servers.
- CVE-2026-109618: An out-of-memory handling flaw can leave internal request data in an unsafe state, allowing an attacker to trigger memory corruption.
- CVE-2026-109619: PHP can retain internal data that points to memory that has already been freed. A later request may use this invalid data.
The vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The PHP team identifies Apache’s mod_php configuration as particularly high risk because an attack can trigger the flaw before application code runs.
Which PHP Versions Fix the Vulnerabilities?
The PHP project released patched versions on October 21, 2026.
| PHP branch | Fixed version |
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Note: PHP 8.1 and older versions no longer receive routine security updates from the PHP project.
What Should Website Owners Do?
Website owners should check their PHP versions and install the appropriate security updates. Those using managed hosting should contact their providers to confirm that the fixes are installed.
Administrators should also review containers, third-party applications, and hosting services for vulnerable PHP components. Updating a content management system alone may not fix a vulnerability in the underlying PHP runtime.
Checking server configurations and identifying technical issues are also important parts of maintaining a website’s technical SEO health.
If immediate patching isn’t possible, organizations should restrict public access to vulnerable systems where feasible until a security fix.
Why Does This PHP Security Update Matter?
PHP supports widely used websites and applications, making vulnerabilities in its core runtime a concern for website owners and hosting teams. Successful exploitation could compromise server operations or expose sensitive data.
Amazon reported detecting a PHP2Shell exploitation attempt in its security telemetry on October 17, four days before public disclosure.
This highlights the need to patch affected systems promptly rather than wait for evidence of an attack against a specific website.
