On 21 October 2026, PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, two remote code execution flaws that are already being exploited. A third flaw remains unpatched.
Last week saw the disclosure of two critical vulnerabilities in the core of the PHP engine, nicknamed PHP2Shell. They allow an unauthenticated attacker to execute code remotely on a web server simply by sending it specially crafted HTTP requests. Because they sit in PHP itself, well-written application code is not enough to protect against them.
The two flaws at a glance
- CVE-2026-109618 (CVSS v4 score: 9.2): an error in out-of-memory handling that can be triggered by malicious multipart requests.
- CVE-2026-109619 (CVSS v4 score: 9.2): a use-after-free caused by state kept between requests, notably through session upload progress tracking, which is enabled by default.
Apache servers running mod_php are the most exposed, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected. According to published analyses, an attacker can also read PHP process memory and recover passwords, tokens or keys from it.
Exploitation is already under way
Exploitation attempts were observed from 21 October, the day the fixes were released. On 26 October, the US agency CISA added both flaws to its catalogue of actively exploited vulnerabilities. As a precaution, several organisations temporarily took online services down while they updated, including public services in the Netherlands.
What to do now
- Update PHP to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a Linux distribution package that lists both CVEs, then restart Apache, PHP-FPM and all PHP processes. Updating WordPress or another application does not update PHP.
- Plan the migration of older versions: PHP 8.1 and earlier no longer receive regular official updates, and PHP 8.2 reaches end of life on 31 December 2026.
- Until you can patch, apply the temporary measures recommended by vendors: disable
session.upload_progress.enabledin the server configuration, limit request size (post_max_size) and, on PHP 8.5, disablefatal_error_backtraces. These measures reduce the risk but do not replace the update. - Look for signs of compromise: unusual multipart requests followed by memory errors, repeated HTTP 500 errors, abnormally long PHPSESSID cookies and unexplained PHP process restarts.
A third flaw is still unpatched
On 23 October, PHP reported another vulnerability, CVE-2026-115560, linked to session serialisation and upload progress tracking. It is not fixed by the 21 October releases. It only affects certain configurations, but the protection is simple: disable session.upload_progress.enabled at server level, then restart PHP processes.
How 2SC-TECH can help
Our cybersecurity teams can inventory your PHP servers, apply the fixes and temporary measures, then check for signs of compromise. Contact us for a fast response, remotely or on site.
Related expertise: Cybersecurity
