PHP2Shell, a pair of unauthenticated php remote code execution flaws in PHP's core, leaked online a day ahead of its planned disclosure, and PHP's own security team has confirmed that the interim workaround circulating since the leak doesn't actually close both bugs. CVE-2026-109618 and CVE-2026-109619 affect essentially every way PHP serves a web request, and emergency patches shipped October 21, 2026, after watchTowr and Cloudflare both reported active exploitation attempts before the fix was even public.

Jump to what we checked on our own PHP fleet if you run any web-facing PHP installation you haven't patched yet today.

What the PHP2Shell Vulnerability Actually Breaks

CVE-2026-109618 lives in how PHP handles running out of memory. When a request exceeds its memory limit, PHP aborts it mid-operation using a jump out of whatever it was doing, and in several places that abort leaves internal request data only half set up. Subsequent cleanup code trusts that invalid state as valid.…