PHP2Shell: Two Critical PHP Flaws Allow Remote Code Execution. Patch Today

If you run anything on PHP, and that includes every WordPress site out there, stop what you’re doing. On October 21 the PHP team shipped emergency releases for two critical flaws, nicknamed PHP2Shell, that can let an unauthenticated attacker run code on your server.

The bugs

• CVE-2026-109618: RCE through out-of-memory corruption. Running out of memory can interrupt PHP while request data is only half set up, and cleanup then treats the bad data as valid.
• CVE-2026-109619: RCE through stale global state. Request state can outlive its freed memory, and the next request on the same worker can use it.
• Both are rated CVSS v4.0 9.2. Every PHP install serving web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team says the risk is highest for mod_php, where a demonstrated exploit fires before any application code runs.
• CISA is urging everyone to patch now. It hadn’t seen exploitation yet when it published, but it says PHP 8.1 and older should be taken offline until they’re upgraded.

What to do

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Distros got the patches early, so check for vendor packages. Distro version numbers may not match upstream, so check the changelog for the CVE IDs.
• If you use the remirepo.net repo, PHP says it won’t have updates today. Switch to distro packages or build from source.
• Can’t patch yet? The PHP team lists partial measures. Set session.upload_progress.enabled=0 in php.ini or the FPM pool and restart every worker, set a low post_max_size, and on 8.5 set fatal_error_backtraces=0. These reduce exposure but do not make you safe.
• Watch for PHP workers launching shells or downloading tools.

My take

This is a drop-everything bug. Pre-auth RCE in the language runtime means your plugins and your WAF won’t save you. Patch, restart every worker (not just reload), and confirm the version afterward. I put the step-by-step for a WordPress box in a separate How-To.

Update, Oct 22: Attacks started before disclosure

Amazon’s MadPot honeypots spotted a PHP2Shell exploit attempt on October 17, four days before patches shipped, and multiple proof-of-concept exploits about 12 hours before release. Cloudflare saw thousands of attempts in the 10 hours before disclosure. That grew to millions after, with attackers tweaking payloads to get past WAF rules. Hadrian says most attacks abuse PHP’s session upload-progress path. If you haven’t patched, do it now.

Have a blessed day! And Happy Hacking!

References & Further Reading

• PHP Security Advisory: Critical remote code execution vulnerabilities, update now (PHP.net)
• Critical Vulnerabilities in PHP Require Immediate Patching (CISA)
• NCSC-NL php2shell README (GitHub)
• PHP Downloads
• Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure (The Register)