PHP core remote code execution (CVE-2026-109619)

PHP says the two PHP2Shell flaws can allow unauthenticated remote code execution. For this one, the GitHub advisory says PHP keeps global state such as error, session, object and extension state. That state can stay in a persistent worker and point to memory owned by a finished request.A fatal error, such as an uncaught error or a timeout, can interrupt an operation before it resets its state. A later request on the same worker can then read the stale state, for example while PHP applies INI settings or handles session upload progress. The advisory confirms two cases: the PHP 8.5 fatal error backtrace path, and session upload progress after an out-of-memory or other fatal error.The advisory describes an unauthenticated heap use-after-free that can run code with the web worker's privileges.PHP's release text does not report exploitation. NCSC-NL notes that public proof-of-concept exploits exist, and Sansec reports early attacks seen by Cloudflare on 21 October. The CISA Known Exploited Vulnerabilities catalog did not list this CVE in the version we read.Read the PHP2Shell analysis for the full picture. The first flaw is covered on the CVE-2026-109618 page.

PHP's GitHub advisory lists every release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected. PHP says all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.2 reaches end of life on 31 December 2026. PHP says 8.1 and older no longer receive updates from the PHP project, and some distributions and LTS vendors provide backported fixes. The advisory does not say how far back older branches are affected.