On 21 October 2026 the PHP project fixed two critical bugs, CVE-2026-109618 and CVE-2026-109619 , quickly nicknamed php2shell . Both can allow unauthenticated remote code execution. In the first, an out-of-memory error can interrupt PHP while internal request data is only partially initialized; request parsing is the easiest way to get there, but not the only one. In the second, request-owned state survives in a persistent worker after its memory has been freed. Full RCE was demonstrated on Apache mod_php; on PHP-FPM the exposure is more limited and depends on the configuration, but "limited" is not "safe".

The fixed releases were 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and the PHP project published minimal source backports for 7.4, 8.0 and 8.1. Anything older depends on distributions and LTS providers.…