Critical PHP ‘PHP2Shell’ Vulnerabilities Trigger Emergency Patches and Global Cyber Alerts

Two critical vulnerabilities in PHP, the programming language that powers roughly 70 percent of the world’s websites, have set off emergency patching across the internet this week after security researchers began seeing active attempts to exploit them.

The PHP project released security fixes on Wednesday for the flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System, placing them in the critical category.

Under certain conditions, the flaws allow an attacker with no login credentials to run their own code on a vulnerable web server. In the riskiest setups, a single crafted request can trigger the attack before the website’s own code even starts running, according to the PHP project’s security advisory.

What the two flaws do

The first flaw, CVE-2026-109618, comes from badly handled memory overflow that disrupts PHP while it prepares a database query, leaving half-initialized data that cleanup routines then mistakenly treat as valid. The second, CVE-2026-109619, involves internal state that lingers after memory has been freed, allowing the next request processed by the same worker to reuse it.

All common server configurations are affected, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project views mod_php as the highest-risk environment.

Because the flaws sit in PHP’s core engine, they can expose websites even when their owners have written nothing wrong. PHP underpins platforms such as WordPress, Drupal and Joomla, as well as countless custom applications.

Leak pushed the disclosure forward

The PHP project had planned to announce the fixes on Oct. 21. But details surfaced online on Oct. 20, according to the attack-surface management firm watchTowr, forcing the disclosure forward. Cloudflare deployed firewall rules to block the flaws before the public release.

watchTowr reported that active exploitation attempts began on Oct. 21. Huntress, a detection firm, said it had seen no successful compromises among its clients as of the evening of Oct. 21. Palo Alto Networks’ Unit 42 estimated that about 22.6 million potentially vulnerable PHP instances are exposed on the internet.

Governments urge immediate patching

India’s Computer Emergency Response Team issued a critical alert on Oct. 21, warning that attackers could exploit the vulnerabilities to run commands on targeted systems and take complete control of them. France’s cybersecurity agency, CERT-FR, and the European CERT both recommended isolating servers that cannot be updated right away.

A joint warning on Oct. 21 from the European Commission, ENISA, CERT-EU and Europol’s cybercrime center told organizations to identify affected systems, apply the available updates and, where immediate fixes are not possible, consider disconnecting exposed applications from public networks.

The only complete fix is updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the version in use. The PHP project no longer issues patches for PHP 8.1 and earlier, and security support for PHP 8.2 ends on Dec. 31, 2026.

Security firm Calif, which reported the memory overflow flaw to the PHP project on Aug. 11 after identifying it with an AI agent as part of OpenAI’s “Patch the Planet” initiative, says the flaw traces back to research on PHP memory limits first detailed in 2004. Wiz Research confirmed on Aug. 19 that its AI models could achieve unauthorized code execution on Drupal and WordPress installations using the flaws.

Reporting based on coverage by Hackware News, Enterprise Wired, Digit.in, and the PHP project security advisory.