Critical PHP flaws let attackers run code on web servers without a login, and attacks have begun

Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell", let an unauthenticated attacker run code on a server using only a crafted web request. Both score 9.2 on the CVSS v4.0 scale. The bugs sit in PHP core rather than in a framework or plugin, so they can reach anything that uses PHP to serve web requests. Affected setups include PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed, with PHP rating mod_php as the highest risk. Every earlier release is affected.

The PHP security team shipped fixes within about a day of announcing the flaws, after details leaked before the planned embargo. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For branches 7.4, 8.0 and 8.1, PHP has published minimal source backports but no official releases. These should be treated as a stopgap while an upgrade is planned.

Exploitation has been reported. watchTowr saw it in its honeypot network as of October 21, and Tenable relays Cloudflare's CTO saying early attacks are being seen. Other telemetry, such as Patchstack's, shows mostly probing. Reliable public exploits are still scarce. VulnCheck found code execution works on ARM64 and on x86 systems with ASLR turned off, and Red Hat rates exploitation as hard on default PHP-FPM deployments. Neither CVE is in CISA's KEV catalog yet, and no public indicators of compromise have been released. The harder task for many organisations is finding every copy of PHP they run, since it often turns up in unexpected places.