What happened, why it matters, and the practical steps organizations must take now 

A plain-language cybersecurity article for business leaders, IT teams, website owners, and developers 

Current status  Two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, can permit unauthenticated remote code execution on PHP systems serving web requests. Fixed releases became available on 21 October 2026. 

Executive Summary 

A serious PHP security event is underway. The PHP project has released emergency security updates for two critical vulnerabilities, collectively referred to as “PHP2Shell.” An attacker may be able to execute code on a vulnerable web server without first logging in. Because the flaws are in PHP itself, a well-written application can still be exposed if it runs on an affected PHP runtime. 

Immediate action  Inventory every PHP runtime, prioritize all internet-facing services, update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restart the relevant web/PHP services, verify the runtime actually in use, and investigate for signs of compromise. A web application firewall is only a temporary risk-reduction layer, not a replacement for patching. 

The issue in one minute 

• PHP is a server-side programming language used by websites, APIs, content-management systems, e-commerce platforms, and business applications. 

• The newly disclosed flaws can lead to remote code execution, meaning an attacker may run commands or malware on the server. 

• All PHP installations serving web requests are considered at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed configurations. 

• The risk is highest for systems exposed to the internet and for servers that are difficult to update because they run old or unsupported PHP versions. 

• Patching the PHP runtime is the only complete fix. Taking an unpatchable system offline is safer than leaving it exposed. 

What “compromise” could mean 

If exploitation succeeds, the attacker may gain the ability to operate with the permissions of the PHP or web-server process. The practical impact depends on how the server is configured, what files and credentials it can access, and whether it can reach other systems. Possible outcomes include: 

• Website defacement or malicious redirects 

• Theft of application data, database credentials, API keys, or session information 

• Installation of web shells, cryptominers, botnet components, or other malware 

• Service disruption, file encryption, or destructive actions 

• Use of the web server as a foothold to move deeper into the network 

1. What Happened? 

On 21 October 2026, the PHP project published security releases addressing two critical vulnerabilities. Both can enable unauthenticated remote code execution. The flaws are tracked as: 

Vulnerability	Plain-language explanation	Security result
CVE-2026-109618	When an out-of-memory condition interrupts PHP at the wrong point, internal request data may be left only partly initialized. Cleanup code can then treat invalid data as valid.	Memory corruption that can be turned into code execution.
CVE-2026-109619	Internal state associated with one request may remain after its memory is released. A later request handled by the same worker may reuse that stale state before normal initialization.	Use of stale state that can be turned into code execution.

Why this event is unusual 

Many website incidents are caused by a vulnerable plugin, weak password, exposed administrator panel, or insecure application code. This event is different: the defects are in the PHP runtime itself and can be reached before normal application defenses are able to help. The PHP project specifically states that all PHP installations serving web requests are at risk and that updating is the only complete solution. 

Affected and fixed versions 

PHP branch	Minimum fixed release	Required decision
8.5	8.5.12	Update immediately
8.4	8.4.27	Update immediately
8.3	8.3.36	Update immediately
8.2	8.2.35	Update immediately
8.1 or older	No normal PHP-project update	Move to a supported release or obtain a verified vendor backport; otherwise isolate or take offline

2. How an Attack Can Happen 

The exact exploit code is not required to understand the defensive problem. At a high level, the path is: 

1. Exposure  A vulnerable PHP runtime receives web requests from an untrusted source, often the public internet. 

2. Crafted request  The attacker sends specially constructed traffic designed to trigger the runtime flaw. 

3. Runtime failure  PHP enters an unsafe memory or state-management condition before the application can reliably stop it. 

4. Code execution  The attacker gains the ability to execute instructions through the PHP worker or web-server process. 

5. Follow-on actions  The attacker may plant persistence, steal data, alter content, contact external infrastructure, or probe internal systems. 

Most exposed environments 

• Internet-facing websites and APIs running affected PHP versions 

• Apache deployments using mod_php, which the PHP project identifies as the highest-risk configuration 

• Old applications tied to PHP 8.1, 8.0, 7.4, or earlier 

• Appliances, vendor products, or containers that bundle PHP invisibly 

• Shared hosting or multi-tenant servers where one compromised application may affect neighboring assets 

• Servers where the PHP process has broad file, database, cloud, or network permissions 

3. What Organizations Should Do Now 

Phase A: Contain immediate risk 

• Identify every system that runs PHP. Include virtual machines, containers, Kubernetes workloads, serverless images, appliances, internal tools, maintenance pages, and software packages with embedded PHP. 

• Prioritize internet-facing systems and externally reachable management interfaces. 

• If a vulnerable system cannot be patched promptly, remove public access or take it offline. Do not treat a WAF rule as a permanent fix. 

• Preserve relevant logs and forensic evidence before rebuilding or deleting suspicious files. 

• Restrict outbound connections from web servers where operationally possible to reduce command-and-control and malware download opportunities. 

Phase B: Patch correctly 

1. Use the operating-system, container-image, hosting-provider, or software-vendor package intended for the environment. A vendor may backport the fix without changing the visible major/minor version in the same way as php.net. 

2. Update to at least PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 when using official PHP branches. 

3. Restart PHP-FPM pools, Apache, LiteSpeed, containers, and long-running workers. Updating files on disk is not enough if old processes remain in memory. 

4. Check the PHP version used by the web server, not only the command-line version. Multiple runtimes may coexist on one host. 

5. Retest application functions, upload workflows, scheduled jobs, payment paths, authentication, and integrations after updating. 

Important verification point  A successful package installation does not prove the website is using the patched runtime. Confirm the live handler, restart workers, and verify through trusted operational methods. Remove any temporary diagnostic page immediately after verification. 

Phase C: Hunt for signs of compromise 

Patching closes the vulnerability but does not remove an attacker who entered before the update. Review activity from PHP workers and the surrounding operating system. Look for: 

• PHP, Apache, Nginx, or LiteSpeed processes spawning shells or command interpreters 

• Unexpected downloads or outbound connections initiated by web-server accounts 

• New or recently modified .php files in upload, cache, image, temporary, or public directories 

• Obfuscated PHP code, long encoded strings, unexpected eval/assert usage, or unfamiliar auto-prepend files 

• New scheduled tasks, services, startup entries, SSH keys, users, or privilege changes 

• Unexpected access to secrets, database dumps, configuration files, or cloud instance metadata 

• Log gaps, disabled security tools, altered timestamps, or evidence-clearing commands 

• Unusual authentication sessions, administrator actions, payment changes, redirects, or injected JavaScript 

Phase C: Hunt for signs of compromise 

Patching closes the vulnerability but does not remove an attacker who entered before the update. Review activity from PHP workers and the surrounding operating system. Look for: 

• PHP, Apache, Nginx, or LiteSpeed processes spawning shells or command interpreters 

• Unexpected downloads or outbound connections initiated by web-server accounts 

• New or recently modified .php files in upload, cache, image, temporary, or public directories 

• Obfuscated PHP code, long encoded strings, unexpected eval/assert usage, or unfamiliar auto-prepend files 

• New scheduled tasks, services, startup entries, SSH keys, users, or privilege changes 

• Unexpected access to secrets, database dumps, configuration files, or cloud instance metadata 

• Log gaps, disabled security tools, altered timestamps, or evidence-clearing commands 

• Unusual authentication sessions, administrator actions, payment changes, redirects, or injected JavaScript 

5. Practical Response Checklist 

Control	Completion evidence	Status
Asset discovery	All internet-facing and internal PHP systems identified, including bundled and containerized runtimes	☐
Risk prioritization	Public systems and mod_php deployments placed first in the response queue	☐
Patch	Runtime updated to a fixed release or verified vendor backport	☐
Restart	All PHP workers, web services, containers, and long-running jobs restarted	☐
Verification	Live web runtime confirmed as patched; duplicate runtimes checked	☐
Exposure control	Unpatchable services isolated or taken offline	☐
Detection	Logs and endpoint telemetry reviewed for PHP/web processes spawning tools or shells	☐
Integrity	Application files compared with trusted builds; unexpected PHP files investigated	☐
Credentials	Potentially exposed passwords, API keys, tokens, certificates, and database credentials rotated based on investigation findings	☐
Recovery	Clean rebuild and data restoration procedures ready if compromise is confirmed	☐
Communication	Business, application owners, security operations, hosting/vendor contacts, legal/privacy, and incident management aligned	☐
Follow-up	Unsupported PHP and abandoned applications entered into a funded modernization plan	☐

6. Guidance by Role 

For business leaders and service owners 

• Ask for a complete asset count and named owner, not only confirmation that the “main website” was patched. 

• Require evidence that the running web runtime was verified after restart. 

• Authorize downtime where needed. A short controlled outage is preferable to leaving an exposed unpatchable system online. 

• Ensure incident-response and customer-notification decisions are based on investigation results, business impact, and applicable legal obligations. 

For system administrators and platform teams 

• Patch through the correct vendor channel; verify package provenance and signatures. 

• Check every execution model: PHP-FPM, mod_php, php-cgi, containers, alternate pools, cron jobs, and vendor appliances. 

• Review service accounts, filesystem permissions, outbound access, and secrets available to the PHP process. 

• Capture logs and volatile evidence if malicious activity is suspected before restarting or rebuilding. 

For developers 

• Do not assume framework updates alone fix this incident; the PHP runtime itself must be updated. 

• Run automated tests against the fixed runtime and address compatibility issues promptly. 

• Upgrade unsupported libraries and remove unused packages and endpoints. 

• Add security tests for injection, XSS, authorization, file upload, session handling, and secret exposure. 

7. Frequently Asked Questions 

Is WordPress itself the vulnerability? 

No. The current critical issue is in PHP itself. A WordPress, Drupal, Laravel, Symfony, Magento/Adobe Commerce, or custom application can still be exposed if its underlying PHP runtime is vulnerable. 

Does a WAF fully protect the server? 

No. CISA states that a WAF may provide some protection until systems are patched. The PHP project says only updating is a complete solution. 

If no exploit alert was triggered, are we safe? 

Not necessarily. Absence of an alert is not proof of absence. Confirm the patch, review logs and endpoint activity, and investigate anomalies. 

Can we patch only the web application? 

No. Application and plugin updates remain important, but this incident requires updating the PHP runtime or applying a verified vendor backport. 

What if the application requires an old PHP version? 

Treat that as an urgent risk decision. Obtain a supported vendor backport or move the application to a supported runtime. If neither is possible, isolate or take the service offline while remediation is arranged. 

Should credentials be rotated? 

Rotate credentials when logs, telemetry, file integrity, or other evidence suggests exposure, or when incident-response policy requires it. Prioritize secrets accessible to the web-server account and revoke active sessions or tokens where relevant. 

Conclusion 

The current PHP security event is a patch-now situation. The key message is simple: find every PHP runtime, update it, restart it, verify it, and check whether compromise occurred before the patch. Organizations should then use the event to correct the conditions that turn one software flaw into a major breach: unsupported platforms, excessive permissions, unclear ownership, weak segmentation, exposed secrets, and insufficient monitoring. 

Final takeaway  Patching prevents new exploitation. Investigation determines whether damage has already occurred. Hardening limits what the next vulnerability can do.