What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
PHP2Shell, otherwise known as CVE-2026-109618 and CVE-2026-109619, are two Remote Code Execution vulnerabilities in PHP, a scripting language used to build and run web applications and websites. Both allow an unauthenticated attacker to execute their own code on a server running PHP, potentially taking control of it.
CVE-2026-109618 is triggered when PHP runs out of memory partway through setting up a request, leaving internal data half built for the cleanup code to trust. CVE-2026-109619 comes from internal state that outlives the request memory it points to, so the next request that the same PHP worker picks up can act on that leftover data. Both are rated CVSS v4.0 9.2.
| CVE | Description | CVSS | Exploited in the wild |
|---|---|---|---|
| CVE-2026-109618 | Remote Code Execution in PHP via out-of-memory corruption | 9.2 (v4.0) | Yes, per watchTowr |
| CVE-2026-109619 | Remote Code Execution in PHP via stale global state | 9.2 (v4.0) | Yes, per watchTowr |
Is PHP2Shell being exploited in the wild?
Yes. Exploitation has been observed in the wild since October 21, 2026, through watchTowr’s Attacker Eye global honeypot network. As of October 22, 2026, CISA has not added either CVE to its Known Exploited Vulnerabilities catalog.
How did PHP2Shell come to light?
The vulnerabilities were discovered by researchers at Calif and reported to PHP for a coordinated disclosure. On October 20, 2026, details leaked on social media before the planned disclosure date of October 22. The same day, the PHP security team announced an emergency security release for October 21 at 14:00 UTC, and watchTowr became the first in the industry to confirm publicly that the vulnerabilities were real. PHP published its advisory and fixed releases on October 21.
How is watchTowr helping PHP customers?
- Adversary Sight engine identified PHP instances across client environments and assessed exposure.
- Rapid Reaction identified exposure to this vulnerability across the watchTowr client base, giving teams the time they need to act.
- Active Defense deployed autonomous mitigation rulesets to watchTowr Platform client networks.
What is PHP?
PHP is a scripting language used to build dynamic websites and web applications. Enterprise networks commonly run PHP-based content management systems and internal tools, so servers running PHP often handle customer data and business logic reachable from the internet.
Which PHP versions are affected?
| Product | Affected Versions | Fixed Version |
|---|---|---|
| PHP 8.2.x | < 8.2.35 | 8.2.35 |
| PHP 8.3.x | < 8.3.36 | 8.3.36 |
| PHP 8.4.x | < 8.4.27 | 8.4.27 |
| PHP 8.5.x | < 8.5.12 | 8.5.12 |
| PHP 7.4, 8.0 and 8.1 | All versions | No official release. Use a distribution or LTS vendor package, or PHP’s minimal source backports |
| PHP 7.3 and older, including PHP 5 | All versions | No fix available. Upgrade to a supported branch |
- Every PHP installation that serves web requests is in scope, whether it runs under PHP-FPM, Apache mod_php, php-cgi, LiteSpeed or FrankenPHP.
- PHP considers the risk highest for Apache mod_php, where an attack can succeed before any of the application’s own code has run.
- watchTowr has confirmed that older, unsupported branches, including PHP 5, are also affected, so discovery should cover every PHP installation, not only supported versions.
Prioritize internet-facing servers, starting with any that run PHP as an Apache module.
How do I fix PHP2Shell?
Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, matching the branch in use. PHP states that no configuration change fully mitigates these vulnerabilities.
- Inventory every server and application that runs PHP, starting with internet-facing systems.
- Update each installation to the fixed release for its branch. Linux distributions were given the patches ahead of release, so look for updated packages from your distribution.
- Restart every PHP worker after updating so the fix takes effect.
- For PHP 7.4, 8.0 and 8.1, use a distribution or LTS vendor package or PHP’s minimal source backports, or upgrade to a supported branch.
- Restrict internet access to any PHP system that cannot be updated immediately.
What other vulnerabilities does the same bulletin fix?
PHP’s October 21, 2026 security release covers the two PHP2Shell vulnerabilities: CVE-2026-109618 (remote code execution via out-of-memory corruption) and CVE-2026-109619 (remote code execution via stale global state). The same fixed versions address both.
What types of threat actors typically exploit this vulnerability?
No attribution has been made public.
