PHP2Shell is the nickname for two critical PHP flaws disclosed on 21 October 2026: CVE-2026-109618 and CVE-2026-109619 . Together they can let an unauthenticated attacker run code on a server that runs PHP, with a single request. If you run WordPress, WooCommerce, Joomla, Drupal or Magento, or look after client sites that do, this is the checklist I put together from the PHP advisory and the security write-ups published since.

What the bugs are

CVE-2026-109618 (CVSS v4.0 9.2): if PHP runs out of memory while request data is only partly initialised, cleanup later treats that data as valid.

CVE-2026-109619 (CVSS v4.0 9.2): state from one request survives, after its memory is freed, into the next request handled by the same worker (a use-after-free). An earlier circulated score of 10.0 was corrected by the PHP Foundation.

Every web SAPI is in scope: PHP-FPM, Apache mod_php , php-cgi, FrankenPHP and LiteSpeed.…