On October 21, the PHP project published a security advisory titled "Critical remote code execution vulnerabilities, update now": PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp). Both are rated Critical with a CVSS v4 score of 9.2 in their GitHub advisories, and both can allow unauthenticated remote code execution. The project says all PHP users are strongly encouraged to update immediately. The pair is also being called php2shell.

Who Is Affected

  • The advisory covers all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers the risk highest for mod_php, with a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs.
  • CVE-2026-109618: out-of-memory (OOM) handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat that invalid data as valid.
  • CVE-2026-109619: request-owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may use that stale state before normal initialization resets it.
  • The bug is in the PHP runtime itself, not in WordPress or a plugin. WordPress said on the same day that no WordPress update is required or planned for these issues; it is PHP that needs updating. In WordPress you can see the PHP version under Tools → Site Health → Info → Server.

How to Update

  • Check the version with php -v. If you build from the official source, move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  • If you use distribution packages: Ubuntu published USN-8948-1 on October 21, with php8.1 8.1.2-1ubuntu2.28 for 22.04 and php8.3 8.3.6-0ubuntu0.24.04.13 for 24.04; Debian 13 has php8.4 8.4.27-1~deb13u1 (DSA-6574-1) and Debian 12 has php8.2 8.2.35-1~deb12u1 (DLA-4848-1). After sudo apt update && sudo apt upgrade, restart PHP-FPM or Apache (for example sudo systemctl restart php8.3-fpm) — workers that are already running won't pick up the new code on their own.
  • PHP 8.1 and older no longer receive updates from the PHP project; if your distribution backports the fixes (like Ubuntu 22.04's 8.1 above), simply update the system packages. Given the severity, the PHP security team also provided minimal source backports for 7.4, 8.0 and 8.1 for people who build from source.
  • PHP installed by a panel such as aaPanel, or PHP inside a Docker image, doesn't come from the system's apt: check the panel for a new version, or pull the updated image and recreate the container. See managing a VPS with aaPanel and Docker on a VPS.

If You Can't Update Yet: The Official Stopgaps

The PHP team stresses that only an update is a complete solution; the measures below reduce exposure to specific attack paths but do not make an installation safe:

  • For CVE-2026-109618: set memory_limit=-1, preferably in a way applications can't override (such as php_admin_value in the FPM pool or Apache configuration), and set a low post_max_size — 8M for applications that don't need file uploads, 32M if they do — keeping upload_max_filesize below it.
  • For CVE-2026-109619: set session.upload_progress.enabled=0 and restart every worker, in php.ini, an FPM pool or the server configuration — not through ini_set() or FPM .user.ini files. On PHP 8.5, also set fatal_error_backtraces=0.
  • On October 23 the PHP team added an informational advisory: even on 8.5.12, keep session.upload_progress.enabled=0 until the next regular release, because a related issue with an unusual trigger, CVE-2026-115560, will only be fixed then.

A CDN in Front Doesn't Replace Patching

Cloudflare said on October 21 that the vulnerabilities leaked before the official release and that it had observed attack traffic targeting its customers; since 03:02 UTC on October 21, sites using its free or paid WAF have been protected by default. Cloudflare itself says you should still patch PHP. And a WAF only filters traffic that passes through it: if your origin IP can be reached directly, an attacker can go around the CDN. Once you have updated, if the site was exposed to the internet before, go through investigating a compromised VPS to look for unexpected processes and unfamiliar files. WordPress owners should also make sure September's WordPress core flaw is patched, and nginx users should look at the five nginx fixes released on October 14.