The PHP security team released emergency patches for two critical remote code execution flaws, collectively tracked as PHP2Shell, after details leaked ahead of a planned October 22 disclosure, The Hacker News reported. BleepingComputer identified the bugs as CVE-2026-109618 and CVE-2026-109619. Anyone running a web server on PHP has a runtime to update.
That is a large group. BleepingComputer reports that PHP "powers 75% to 80% of all websites," including those on CMS platforms like WordPress. The flaws sit in the PHP runtime, not in any application, so a site is exposed even when its own code is secure, The Hacker News reported. This PHP2Shell critical vulnerability cannot be fixed from inside the application.
How Did a Leak Force an Early Release?
On 20 Oct 2026, the PHP security team gave advance notice of a release scheduled for 21 October 2026, addressing two critical vulnerabilities, both rated CVSS v4.0 9.2, according to PHP. The notice also said the team reserved the right to release earlier if details of either flaw became public or if exploitation appeared in the wild.
Both conditions arrived. The Hacker News reported that PHP published the fixes around the scheduled release time on October 21, a day after details leaked.
SecurityWeek relayed a further complication. The PHP Foundation said Chainguard published built images containing the fix six hours before the coordinated release, disregarding weeks of work toward coordinated disclosure.
Cloudflare said it observed attack traffic aimed at its customers while the flaw was leaked and before the official release date. It also saw attackers mutating payloads to get around its protections.
What Do the Two Flaws Actually Do?
PHP's advisory describes both as capable of unauthenticated remote code execution. CVE-2026-109618 is labelled "RCE via OOM corruption": out-of-memory handling can interrupt PHP while internal request data is only partially initialized. CVE-2026-109619 is labelled "RCE via stale global state": request-owned internal state can survive after its backing memory has been freed.
The Hacker News reported that an attacker can read memory from the PHP worker process, which may hold passwords, authentication tokens, API keys and certificates belonging to other requests.
The PHP security team singled out one deployment type. "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."
All installations serving web requests are at risk, the advisory says, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Who Found Them, and Why Now?
BleepingComputer reports the two unauthenticated flaws were discovered by researchers at Calif, Wiz and OpenAI. SecurityWeek reported that the OOM-to-RCE issue was independently reported by Calif and OpenAI on August 11.
The history is longer than that. Calif said an initial OOM flaw in PHP was discovered in 2020 and rediscovered during a PHP audit in 2024, but was not patched because exploitation was not proven, SecurityWeek reported.
The researchers say AI models helped turn these long-standing flaws into working exploits, according to The Hacker News. One researcher did in about a week what they say would otherwise have taken a team months.
Wiz said the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."
The Hacker News reports both flaws affect nearly every PHP version back to PHP 5.4.
Is Anyone Exploiting It?
Reports differ in degree. SecurityWeek reported that WatchTowr saw the first in-the-wild exploitation attempts around the time patches landed but had not observed successful ones. Jake Knott, WatchTowr's head of threat intelligence, said: "Whilst nobody has been successful to date, we don't expect that will last long."
SecurityWeek, relaying a Hadrian report, said Hadrian saw php2shell exploited in the wild at scale, with most attacks abusing PHP's session upload-progress path.
Some organisations have already gone dark. The Hacker News reported that BambooHR took its service offline across the United States, Canada and Ireland as a precaution. It warned that payroll would be interrupted and had no restoration time. In the Netherlands, citing broadcaster NOS, the outlet reported that MijnOverheid, DigiD, the lower house of parliament's site, the national cyber-security center and several education systems went offline.
Help Net Security quoted researcher Kevin Beaumont: "The PHP situation will lead to a mass of incidents – it's one of the biggest vulns in years."
