Two critical PHP bugs fixed on 21 October 2026, CVE-2026-109618 and CVE-2026-109619 (together called PHP2Shell), can be chained for unauthenticated code execution on a web server. AlmaLinux scores both 9.2 on CVSS v4.0, and an exploitation attempt was recorded on 17 October, before public disclosure. If you run PHP anywhere, this is a runtime upgrade, not an application update.

What is affected

Any PHP serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed

mod_php is the most exposed setup; remote code execution was also confirmed on PHP-FPM for CVE-2026-109619

CVE-2026-109618: memory corruption when a request hits the per-request memory limit (a crafted multipart upload can trigger it)

CVE-2026-109619: stale state surviving between requests on the same worker, leading to a use-after-free

Updating WordPress, Drupal, Laravel or plugin code does nothing here

A practical patch flow

Build an inventory: prod sites, staging boxes, admin panels, old microsites and vendor…