Two flaws in PHP can let an unauthenticated web request trigger remote code execution. The PHP project released fixes on October 21 for the vulnerabilities commonly called PHP2Shell.
The affected layer runs underneath application code. PHP's security team says a demonstrated attack against Apache's mod_php can trigger before the website's own program starts. Updating a content management system alone does not replace updating the PHP runtime.
CVE-2026-109618 concerns out-of-memory handling. A failure can interrupt the initialization of internal request data, after which cleanup may handle invalid data as valid. That can corrupt memory.
CVE-2026-109619 concerns stale internal state. Data owned by one request can remain after its backing memory has been freed. Another request handled by the same worker may encounter that state before normal initialization resets it.
PHP identifies installations serving web requests as at risk, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. The project considers the demonstrated mod_php route the highest risk.
The fixed upstream versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions can deliver fixes through their own packages, so an administrator also needs the vendor's advisory to interpret a packaged version.
PHP 8.1 and older no longer receive regular updates from the project. Some vendors supply backports. The security team also provided minimal source backports for 7.4, 8.0 and 8.1 because of this incident's severity.
The advisory lists temporary measures for particular attack paths, but explicitly says they do not make an installation safe. The complete solution is an update.
