Last update: 21/10/2026 - 3.43pm (BST)
Background
On 21 October 2026 maintainers at PHP – an open-source language designed to build websites - published an advisory indicating that patches for two critical vulnerabilities would be released at 14:00 UTC. Both vulnerabilities have a severity rating of 9.2 out of 10, and have been dubbed ‘PHP2Shell’. These are being tracked as CVE-2026-109618 and CVE-2026-109619.
PHP is a server-side scripting language used for web development, commonly used on platforms built with Content Management Systems such as WordPress, Magento and Laravel.
Read the PHP Advisory here: https://www.php.net/archive/2026.php#2026-10-20-1
What to do now
The vulnerabilities affect versions 5 through to 8.5, affecting all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php_cgi, FrankenPHP and Litespeed. Mod_php has been deemed the highest risk, due to a demonstrated exploit being available to trigger the attack before application code runs. Exploitation of these vulnerabilities can allow unauthenticated remote code execution.
Patches are now available for versions 8.2, 8.3, 8.4 and 8.5. It is advised to apply the patches included in the following version releases:
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
Note you may rely on packages being available with these new versions, which are expected to release over the next few hours. An alternative is building php from the source code.
According to the guidance released by PHP as of 13:35 UTC, the only full mitigation for all versions 8.1 and earlier is to upgrade to a release containing the patch. If this is not possible, it is advised to follow the mitigation guidance released by PHP, linked below.
Further details:
RCE via OOM corruption: GHSA-w8hw-w9fx-j79w
RCE via stale global state: GHSA-6wmf-4rv5-p3rp
Package Status: https://ma.ttias.be/php-cve-2026-109618-patch/#package-status
Please contact S-RM if you are concerned that your organisation may be exposed or if you identify signs of suspicious activity.
