PHP core remote code execution (CVE-2026-109618)

PHP says the two PHP2Shell flaws can allow unauthenticated remote code execution. For this one, the GitHub advisory says PHP uses longjmp() to leave the current context on an out-of-memory error. Request memory can be reachable before initialization finishes, so a failed allocation can leave it invalid, and shutdown may then read it.The advisory says several out-of-memory strategies can lead to remote code execution and names multipart parsing issues as one trigger. PHP rates the risk highest for mod_php, where it has a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs.PHP's release text does not report exploitation. NCSC-NL notes that public proof-of-concept exploits exist, and Sansec reports early attacks seen by Cloudflare on 21 October. Our own search found about 380 new GitHub repositories in the first 36 hours that mention PHP2Shell, and we cannot vouch for any of them. The CISA Known Exploited Vulnerabilities catalog did not list this CVE in the version we read.Read the PHP2Shell analysis for the full picture. The second flaw is covered on the CVE-2026-109619 page.

PHP's GitHub advisory lists every release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected. PHP says all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.2 reaches end of life on 31 December 2026. PHP says 8.1 and older no longer receive updates from the PHP project, and some distributions and LTS vendors provide backported fixes. The advisory does not say how far back older branches are affected.