If you run anything on PHP, you have probably already heard the noise. Two critical flaws in PHP itself, nicknamed PHP2Shell, let an attacker run their own code on your server without logging in and without touching anything more exotic than a web request. They are tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10, and PHP shipped the fixes on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The short version of what to do is boring and non-negotiable: update, then restart.

What makes this one worth paying attention to is where it lives. This is not a bug in a plugin or a framework or your own code. It sits in PHP core, underneath all of that, which means it reaches your application no matter what you built it with. PHP runs a huge slice of the web, so when the interpreter itself springs a leak, a lot of servers spring it at the same time.

The Part Where I Explain What Actually Broke

Both flaws end in the same place, which is code running on your box with the privileges of the PHP worker. They get there differently, and the difference matters a little when you are deciding what to do if you cannot patch this minute.

The first one, CVE-2026-109618, shows up when PHP runs out of memory halfway through setting up a request. Its error handling jumps out of the normal flow, and that jump can leave internal data only half built. The cleanup code then runs against that half-built state and trusts it, which is the opening. PHP says it proved this one out against Apache mod_php with default settings, and it is reachable while PHP is parsing the kind of request a file upload uses.

The second one, CVE-2026-109619, is a stale-pointer problem. PHP holds onto references to request data after the memory behind that data has already been freed. Since one worker handles request after request, the next request that worker picks up can land on those dead pointers, and from there you get memory disclosure and, eventually, code execution. This one has been validated on both mod_php and PHP-FPM.

You do not need to hold the internals in your head to act on this. The thing to take away is that the weakness is in the engine, not in your app, so the fix has to happen at the engine.

Why Your Usual Defenses Do Not Help Here

This is the uncomfortable bit. On Apache mod_php, PHP demonstrated that the attack can succeed before any of your application’s own code runs. All the input validation and auth checks you wrote are downstream of the point where this fires, so they never get a turn. That is also why “we validate everything” is not an answer this week.

The exposed surface is large, too. Palo Alto’s Unit 42 put the number of potentially vulnerable exposed instances at more than 22.6 million based on their telemetry, and the flaws go back through old, end-of-life PHP as far as PHP 5. Shared and managed hosting is the soft spot, since those servers tend to run older bundled PHP and patch slowly. 

One more wrinkle on timing. Details leaked on October 20, a couple of days before the planned coordinated disclosure, which is why PHP pushed out an emergency release rather than a quiet scheduled one. watchTowr says it has seen exploitation in the wild through its own honeypots since October 21, though as of October 22 CISA had not yet added either CVE to its Known Exploited list. 

What to Actually Do

Update to the fixed release that matches your branch, so 8.5.12, 8.4.27, 8.3.36, or 8.2.35. A lot of Linux distributions got the patch early, so your package manager may already have it waiting.

Then restart. This trips people up, so it is worth saying plainly: running PHP workers keep the vulnerable code in memory until they recycle, so an update that nobody restarted is an update that has not taken effect yet. Restart every service that loads PHP, not just the one you were thinking of.

If you are stuck on PHP 7.4, 8.0, or 8.1, there is no normal release for you, but PHP published minimal source backports and your distribution may have its own package. The real fix for those is to move to a supported branch. Anything on 7.3 or older, PHP 5 included, has no patch at all, so get it off the public internet and plan the migration.

And if you genuinely cannot patch in the next hour, PHP named a few partial mitigations that lower the risk without closing it: disabling session.upload_progress.enabled, tightening memory_limit, and turning off fatal_error_backtraces on PHP 8.5. Treat those as a way to buy an afternoon, not as a resolution. The only full fix is the update.

Before You Close the Ticket

Pull your PHP inventory, sort it by what is reachable from the internet, and patch the Apache mod_php hosts at the top first. Once you have patched and restarted, go back and confirm the running version in production rather than trusting the deploy, and skim the logs on anything that was exposed for signs someone already tried.

If you want a second set of eyes on whether the patch really closed the door, a CredShields researcher can walk you through verifying the fix in production, checking exposed hosts for signs of exploitation, and testing the application logic around it that a version bump does not touch. Scope is set per engagement. You can start at CredShields, or look at a sample report to see how we prove and write up each finding.