PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 Patch Critical php2shell RCE Flaws

The PHP project has released emergency updates — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — to fix two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. CISA published an alert the same day, October 21, 2026, urging organizations to patch immediately.

The flaws affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. According to BleepingComputer, they were discovered by security researchers from Calif, OpenAI and Wiz.

Both bugs come from the same underlying problem: PHP can leave its memory in a corrupted state when a request ends abnormally. CVE-2026-109618 exploits out-of-memory handling that can interrupt PHP while internal request data is only partially initialized, while CVE-2026-109619 lets request-owned internal state survive after its memory has been freed, so a later request on the same worker may use stale data.

mod_php carries the highest risk

The PHP security team singled out one deployment method. “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs,” the team said, according to BleepingComputer.

CISA said it had not observed exploitation at the time of publication. Before the patches shipped, however, Cloudflare CTO Dane Knecht confirmed the company was already seeing early attacks targeting the two vulnerabilities, BleepingComputer reported. Cloudflare had already deployed WAF rules for the flaw, as we covered in our earlier story. The UK’s National Cyber Security Centre has also told UK organizations to update PHP systems immediately or take them offline.

What to do if you can’t patch right away

CISA recommends inventorying every system running PHP — noting it is often bundled inside other software — and patching internet-facing systems first. Organizations that cannot update, or that still run PHP 8.1 or earlier, should take PHP-based systems offline until they can be patched. A web application firewall may offer some protection in the meantime.

PHP core developer Gina Peter Banyard warned that no PHP2Shell mitigation fully blocks attacks and that the official patches are the only permanent defense. The PHP team did publish partial mitigations, including setting memory_limit=-1 and a low post_max_size for CVE-2026-109618, and disabling session.upload_progress.enabled for CVE-2026-109619.

PHP 8.1 and older no longer receive updates from the project. The team provided minimal source backports for PHP 7.4, 8.0 and 8.1, and said Linux distributions and vendors received patches in advance, so updated packages should be arriving soon. If you run PHP 8.x, upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now; on PHP 7 or earlier, migrate to a supported release or contact your vendor about backported fixes.

Related reading

Sources

• Critical Vulnerabilities in PHP Require Immediate Patching — CISA Advisories
• PHP ships emergency patches for critical PHP2Shell flaws — BleepingComputer
• PHP patches released for two critical RCEs — LWN.net