Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 , could allow unauthenticated threat actors to remotely execute code on vulnerable web servers. PHP is a widely used server-side scripting language that supports websites, content management systems, and web applications. The vulnerabilities, collectively referred to as PHP2Shell, each carry a CVSS v4.0 score of 9.2 (Critical). On October 21, the PHP development team released emergency security updates following the premature disclosure of vulnerability information. All unpatched PHP installations serving web requests are potentially vulnerable, including those using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The vulnerabilities stem from memory management issues during web request processing. CVE-2026-109618 involves memory corruption during out-of-memory conditions, while CVE-2026-109619 involves the reuse of internal request data after its associated memory has been freed. Successful exploitation could allow threat actors to execute malicious code with the privileges of the affected web server process, potentially enabling unauthorized access, data theft, or further system compromise. Deployments using Apache mod_php face particularly elevated risk, as researchers have demonstrated that a malicious request can trigger exploitation before application code executes.
There are currently no reports of these vulnerabilities being exploited in the wild; however, the potential for exploitation is a high risk.
It is recommended for administrators to immediately identify vulnerable PHP installations, prioritizing internet-facing systems, and update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, as applicable. Organizations using unsupported PHP versions should upgrade to a supported release or obtain vendor-provided security patches where available. Administrators should also review PHP installations bundled with third-party applications and appliances, monitor for suspicious activity, and refer to the official PHP security advisory for additional mitigation guidance if immediate patching is not possible. There are no complete workarounds for these vulnerabilities, and applying security updates remains the only comprehensive remediation.