Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619: What Organizations Should Do Now

Two critical security vulnerabilities affecting PHP were publicly disclosed on October 21, 2026. 

Tracked as CVE-2026-109618 and CVE-2026-109619, and commonly referred to as PHP2Shell, the vulnerabilities can potentially allow an unauthenticated attacker to execute arbitrary code on a vulnerable web server. 

Both vulnerabilities have received a CVSS 4.0 severity score of 9.2, or Critical. Rapid7’s technical analysis reports that environments serving PHP web requests may be at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

This makes the issue particularly important for organizations operating PHP-based websites, portals, APIs, content management systems, and legacy business applications. 

Applications potentially running on PHP infrastructure include platforms such as WordPress, Drupal, Joomla, Magento, Nextcloud, phpMyAdmin, and many custom web applications. Zscaler’s PHP2Shell analysis warns that exploitation requires neither authentication nor user interaction, creating the potential for automated attacks against internet-facing systems.

What are CVE-2026-109618 and CVE-2026-109619?

Both vulnerabilities involve weaknesses within the PHP runtime rather than a particular WordPress plugin, Drupal module, or application framework.

CVE-2026-109618

The vulnerability involves memory corruption during PHP out-of-memory handling that may result in remote code execution under vulnerable configurations.

CVE-2026-109619

This vulnerability involves stale internal state persisting between requests, potentially resulting in a use-after-free condition and remote code execution. 

Rapid7’s analysis describes both vulnerabilities as capable of unauthenticated remote code execution with the privileges of the affected PHP worker.

That distinction is important.

Simply updating WordPress, Drupal, Laravel, Magento, or another application does not necessarily remediate the underlying PHP vulnerability. Organizations must evaluate the PHP runtime installed on the server. 

Which PHP versions should organizations upgrade to?

The upstream fixed releases are:

PHP Branch Fixed Version
PHP 8.5 8.5.12
PHP 8.4 8.4.27
PHP 8.3 8.3.36
PHP 8.2 8.2.35

AWS Security Bulletin 2026-143-AWS lists these versions as the first fixed upstream releases.

Organizations using Linux distribution packages should verify the security status with their distribution vendor because security fixes may be backported without changing to exactly the upstream version shown above. Ubuntu, for example, has released patched packages across supported Ubuntu releases. 

The Role of Connectors in Copilot Integration

1. Inventory every PHP environment

Identify internet-facing and internal applications using PHP. 

Don’t limit the inventory to primary corporate websites. Check: 

  • WordPress sites 
  • Drupal environments 
  • Magento stores 
  • Customer portals 
  • Employee portals 
  • Custom applications 
  • APIs 
  • Administrative interfaces 
  • Legacy applications 
  • Development and staging servers 
  • Cloud VMs 
  • Containers 
  • Forgotten subdomains 

Organizations should also identify which PHP runtime each environment uses. 

2. Determine whether your PHP deployment is vulnerable

Check both: 

PHP version 

and 

how PHP is executed 

such as: 

  • PHP-FPM 
  • Apache mod_php 
  • php-cgi 
  • LiteSpeed 
  • FrankenPHP 

Version checking alone should not be treated as a complete security assessment. 

3. Patch supported PHP installations immediately

Where compatible, upgrade to an appropriate patched release. 

The currently published upstream fixes are PHP: 

8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Because these vulnerabilities may permit remote code execution without authentication, organizations should treat remediation as an emergency security activity rather than postponing it until a routine maintenance window. 

4. Pay special attention to legacy PHP applications

Older applications present the biggest operational challenge. 

AWS states that PHP 5.4 through PHP 8.1 are end-of-life upstream and have no planned upstream fixed release for these vulnerabilities.

Organizations operating older PHP applications therefore need to evaluate options such as: 

  • Vendor-supported backported security packages 
  • Temporary mitigations 
  • PHP runtime upgrades 
  • Application compatibility remediation 
  • Legacy application modernization 

Do not blindly upgrade production PHP without compatibility testing. 

Older applications may depend on deprecated PHP functionality or incompatible frameworks, libraries, themes, modules, or plugins. 

5. Apply temporary mitigations when immediate patching is impossible

When production constraints prevent an immediate upgrade, organizations should review the mitigation guidance provided by PHP and their operating-system or hosting vendor. 

These measures should be regarded as temporary risk reduction, not a permanent substitute for patching. 

For high-risk internet-facing applications that cannot be safely patched or mitigated, organizations should also evaluate whether temporarily restricting access or removing the application from public exposure is appropriate. 

6. Look for signs of compromise

Patching closes the vulnerability going forward, but it does not determine whether an attacker already exploited the system. 

<Tenable’s PHP2Shell advisory> reports exploitation attempts beginning before the public disclosure.

Organizations should therefore review: 

  • Web server access logs 
  • PHP error logs 
  • Authentication activity 
  • Unexpected processes 
  • Newly created accounts 
  • Unexpected scheduled tasks or cron jobs 
  • Modified web application files 
  • Outbound network connections 
  • Web shells or malicious scripts 
  • Privilege escalation activity 

Organizations with EDR, SIEM, WAF, IDS/IPS, or cloud security monitoring should correlate those alerts with affected PHP infrastructure. 

7. Treat legacy PHP as a modernization issue

A critical vulnerability often exposes a larger problem: applications that cannot be patched quickly represent ongoing operational risk. 

If a PHP upgrade breaks the application, organizations should evaluate: 

  • Current PHP and operating system dependencies 
  • Framework and library compatibility 
  • Database dependencies 
  • Third-party integrations 
  • Authentication components 
  • APIs 
  • Hosting architecture 
  • Security controls 
  • Upgrade versus modernization cost 

Moving to a supported runtime reduces the risk of encountering a future vulnerability without an easily deployable security update. 

Need Help Determining Whether Your PHP Applications Are Exposed?

App Maisters helps organizations assess, remediate, and modernize business-critical web applications. 

Our teams can assist with: 

  • PHP environment assessment 
  • Vulnerability remediation 
  • PHP version upgrades 
  • WordPress and CMS remediation 
  • Legacy application compatibility assessment 
  • Application modernization 
  • Cloud migration 
  • Application security reviews 
  • Ongoing application maintenance 

If your organization is running a legacy PHP application and is unsure whether it can safely upgrade, contact App Maisters for a rapid application and infrastructure assessment.