Emergency PHP Patches Fix Two Critical Flaws That Let Strangers Run Code on Web Servers

PHP has released emergency updates for two critical flaws in the language itself. The flaws, together called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), let an attacker without an account run code on a web server. Both are rated 9.2 on the CVSS v4.0 scale. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. Details leaked a day before the planned October 22 disclosure, and PHP published the fixes on October 21.

Because the flaws sit in the PHP runtime and not in any application, a site is exposed even when its own code is secure. Even a simple "Hello World" page on a vulnerable version can be attacked. The flaws affect nearly every version back to PHP 5.4, and every setup that serves web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache mod_php carries the highest risk, because a single unauthenticated request can trigger the attack before any application code runs. Attackers can also read memory from the PHP worker process, which may hold passwords, authentication tokens, API keys and certificates, without first gaining code execution.

The fix is to update the PHP runtime, then restart Apache, PHP-FPM and any long-running PHP workers. Updating an application such as WordPress or Laravel does not update the PHP runtime beneath it. That comes from the server package, the host, or the container image.