PHP2Shell (CVE-2026-109618 and CVE-2026-109619): what it is and how to protect your PHP servers

PHP2Shell is the name given to two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, rated CVSS 4.0 9.2 and disclosed on October 21, 2026. A remote, unauthenticated attacker can use them to run code on the server. The fix is to upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every PHP worker.

They are two flaws in how PHP handles each web request, before your application code runs:

• CVE-2026-109618 (out of memory): if memory runs out while PHP is preparing its internal request data, the cleanup that follows treats half-initialized data as valid.
• CVE-2026-109619 (use-after-free): state left over from one request points to freed memory, and the next request handled by the same worker can use it. PHP confirms it allows reading server memory.

It affects PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The riskiest setup is mod_php: a single unauthenticated request can trigger the attack before your application does anything. That is why it does not matter whether your WordPress, Laravel or Moodle is up to date: the flaw is in PHP.

Yes, there are attempts. Amazon saw an attempt against its honeypots on October 17, four days before disclosure, and now reports broad exploitation. The identifiers leaked on October 20 and PHP moved its release up a day, to October 21 at 14:00 UTC. Unit 42 (Palo Alto Networks) counts more than 22.6 million exposed instances that may be vulnerable.

Two clarifications: the official score is 9.2, not the 10.0 that circulated early, and the PHP Foundation had not identified working exploits at release; the proof-of-concept code going around is unverified. Every vendor's advice is still the same: patch now.

A web application firewall does not fix PHP, but it reduces exposure while patches go in. In Rescue WAF these are configured per site as a virtual patch:

The limits are clear: according to AWS, one of the two flaws is "largely outside the reach of any web application firewall", and traffic that does not go through the WAF is not protected. Patching is still mandatory.

Learn about Rescue SOC. If you suspect your server is already compromised, call our 24/7 incident response; after patching, a penetration test confirms the fix was applied correctly.