PHP2Shell: Inside CVE-2026-109618 and CVE-2026-109619, the Unauthenticated PHP RCE Flaws

Most critical CVEs are scoped to one application you chose to install. PHP2Shell isn't. CVE-2026-109618 and CVE-2026-109619, disclosed by the PHP team on October 21, 2026, sit in PHP's own memory handling — underneath every application written in the language. Rated 9.2 on CVSS v4.0, both allow unauthenticated remote code execution on any PHP install that serves web requests, which is to say, a large share of the internet.

Key takeaways

• Two flaws, one root cause. Both bugs trace back to PHP leaving its internal memory in a corrupted state when a request ends abnormally — CVE-2026-109618 involves cleanup acting on data that was only partly initialized after an out-of-memory condition; CVE-2026-109619 involves request-owned internal state that survives after its memory has already been freed.
• Unauthenticated, no application code required. The PHP team flags mod_php as the highest-risk deployment, where the exploit can trigger before any of your application's own code ever runs — your framework, your input validation, your WAF rule never get a turn.
• Patched releases: 8.2.35, 8.3.36, 8.4.27, 8.5.12. Minimal source backports also shipped for PHP 7.4, 8.0, and 8.1, but those branches are past end-of-life and no longer receive ongoing PHP-project support.
• Exploitation attempts reported within days. Multiple security vendors, including honeypot network operators, reported in-the-wild probing shortly after disclosure — treat active exploitation as the working assumption, not an open question.
• Credit for exploit development partly attributed to AI-assisted analysis, which several researchers flagged as lowering the barrier between disclosure and working exploit.

What's actually broken

Both CVEs come from the same underlying class of problem: PHP's request lifecycle assumes a request ends cleanly. When it doesn't — an out-of-memory condition interrupts processing, or an unusual code path frees memory a request still thought it owned — PHP's cleanup logic can end up acting on data that's partly initialized or already gone. An attacker who can reliably trigger that abnormal ending gets a memory-corruption primitive, and from there, a path to arbitrary code execution, all without ever authenticating to the application running on top of PHP.

That's the part that makes PHP2Shell different from an ordinary application CVE. A vulnerable plugin or outdated library is a problem scoped to the sites that installed it. A vulnerable PHP runtime is a problem scoped to every site running that runtime — WordPress, Laravel, a bespoke internal tool, a vendor appliance that happens to be written in PHP and that nobody on your team thinks of as "a PHP app" at all.

Affected versions and fixes

Why "we'll catch it at the next pentest" doesn't work here

• The exploitation window opened in days, not months. By the time a flaw this severe is public, attackers are already testing it against anything reachable. An annual or semi-annual pentest schedule has no mechanism to catch a runtime-level CVE disclosed three weeks after the last engagement wrapped.
• PHP runtimes hide in places nobody's tracking. Containers with bundled PHP, vendor appliances, legacy internal tools built a decade ago — these rarely show up on a list anyone maintains, let alone one checked against new CVEs the week they drop.
• Version drift happens between tests, not during them. A patch cycle that runs fine at the start of a quarter can quietly fall behind by the end of it, and nothing flags that until something is actively tested again.
• A one-time report is a snapshot of a day that's already passed. PHP2Shell is exactly the kind of disclosure that makes last quarter's pentest report obsolete the moment it's published — not because the test was wrong, but because the world it tested no longer matches the one you're running today.

How continuous monitoring actually helps here

This is the exact scenario our Smart PTaaS continuous model is built for. Instead of a once-a-year engagement that happens to land before or after a disclosure like this, the platform re-checks exposed services and runtime fingerprints on a recurring cycle — so a newly disclosed, widely deployed flaw gets matched against your actual live assets within the same window attackers are already probing, not whenever the next scheduled test happens to fall.

• Recurring exposure checks against every reachable asset in scope, not a one-time snapshot — so a runtime version that was fine last month and isn't this month gets flagged without waiting for a new engagement to be scheduled.
• Fingerprinting beyond the obvious app layer. We identify the actual PHP runtime behind a target, not just the CMS or framework sitting on top of it, which is exactly where a flaw like PHP2Shell hides from a surface-level review.
• Expert-verified findings. When a scan flags a vulnerable version, our team validates real exposure and exploitability before it reaches your report — no noisy version-match alerts with no context.
• Re-tested after you patch. Continuous testing means the loop doesn't end at the alert — we confirm the fix actually closed the gap, on the same cadence, not a manual re-check you have to request and schedule.

What to do this week

1. Inventory every PHP runtime you operate — including versions bundled inside containers, appliances, and vendor products you didn't build yourself.
2. Upgrade to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 as applicable to your branch, treating this as urgent given the unauthenticated, pre-application-code risk profile.
3. Flag anything still on an end-of-life branch (7.4, 8.0, 8.1 or older) for isolation or accelerated migration — a source backport on an unsupported branch is a stopgap, not a long-term fix.
4. Check mod_php deployments first. The PHP team called this configuration the highest-risk path; prioritize it ahead of PHP-FPM or other process-isolated setups if you're triaging under time pressure.
5. Don't wait for the next scheduled test to confirm the fix landed. Verify the patched version is actually live on every exposed instance, not just staged for deployment.

Frequently asked questions

PHP2Shell is a runtime-level flaw with an application-level blast radius, disclosed with an exploitation window measured in days. That's not a problem a once-a-year report can keep up with — it's exactly the gap continuous, expert-verified monitoring exists to close.