PHP says request-owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may use that stale state. It is one of two flaws called PHP2Shell, rated 9.2 on CVSS v4.0, and is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What it allows
PHP says the two PHP2Shell flaws can allow unauthenticated remote code execution. For this one, the GitHub advisory says PHP keeps global state such as error, session, object and extension state. That state can stay in a persistent worker and point to memory owned by a finished request.
A fatal error, such as an uncaught error or a timeout, can interrupt an operation before it resets its state. A later request on the same worker can then read the stale state, for example while PHP applies INI settings or handles session upload progress. The advisory confirms two cases: the PHP 8.5 fatal error backtrace path, and session upload progress after an out-of-memory or other fatal error.
The advisory describes an unauthenticated heap use-after-free that can run code with the web worker's privileges.
PHP's release text does not report exploitation. NCSC-NL notes that public proof-of-concept exploits exist, and Sansec reports early attacks seen by Cloudflare on 21 October. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 26 October, with a due date of 29 October and known ransomware campaign use listed as "Unknown".
Read the PHP2Shell analysis for the full picture. The first flaw is covered on the CVE-2026-109618 page.
In a note on 23 October, PHP named a separate id, CVE-2026-115560, for a related session upload progress path.
Who is affected
PHP's GitHub advisory lists every release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected. PHP says all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.2 reaches end of life on 31 December 2026. PHP says 8.1 and older no longer receive updates from the PHP project, and some distributions and LTS vendors provide backported fixes. The advisory does not say how far back older branches are affected.
Palo Alto Networks lists PAN-OS and Panorama as affected downstream, and says active exploitation has been observed against management interfaces exposed to the internet. It had released 14 of 20 hotfixes by 28 October; see our Palo Alto product status post.
Timeline
- 20 Oct 2026
The PHP security team announces a security release for two critical flaws, both rated 9.2 on CVSS v4.0.
- 20 Oct 2026
CERT-EU advisory 2026-018 names CVE-2026-109618 and CVE-2026-109619.
- 21 Oct 2026
PHP publishes the GitHub advisory GHSA-6wmf-4rv5-p3rp and releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- 21 Oct 2026
PHP says 8.1 and older get no update from the PHP project and points to vendor backports. Our PHP2Shell timeline of the first 36 hours follows the first attacks and the public reaction.
- 26 Oct 2026
CISA adds the CVE to its Known Exploited Vulnerabilities catalog with a due date of 29 October. It lists known ransomware campaign use as "Unknown" and marks forensic triage as required.
- 27 Oct 2026
Wiz Research publishes a status report. It says it has not yet seen successful end-to-end exploitation in its own telemetry. It also reports about a 67% fall in distinct internet-exposed machines vulnerable to PHP2Shell since disclosure. See our main PHP2Shell analysis.
- 28 Oct 2026
Palo Alto's advisory says active exploitation has been observed targeting the PAN-OS management interface when it is exposed to the internet, and rates the issue Critical. See our PAN-OS hotfix dates.
What to do
-
Update PHP
Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the vendor package that carries the fix. PHP says updating is the only reliable mitigation for this flaw.
-
Find every PHP runtime
List servers, containers, control panels and appliances that run PHP, with the version of the binary your web server really uses. Start with the ones reachable from the internet.
-
Reduce exposure if you cannot update
Set session.upload_progress.enabled=0 and restart every worker. On PHP 8.5 also set fatal_error_backtraces=0. PHP says these block only the confirmed paths.
-
Restart and confirm
Restart PHP-FPM or the web server so workers load the new code, then confirm the version again. For 8.1 and older, ask your vendor for a backport or upgrade.
-
Look for signs of abuse
Watch for PHP worker processes that start shells or download tools, and for new files in web roots. Wiz lists addresses seen in PHP2Shell exploitation attempts, scanning and as a payload server between 21 and 26 October, without tying them to one of the two CVEs.
What Brandefense can do
- Check CVE-2026-109619 in Brandefense Atlas, free
See the current status of CVE-2026-109619 in Brandefense Atlas, with the sources behind it.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-109619?
It is a critical PHP flaw, rated 9.2 on CVSS v4.0, that PHP titles "RCE via stale global state". Request state can survive after its memory is freed, and a later request on the same worker may use it. It is one of the two flaws called PHP2Shell.
Which PHP versions fix CVE-2026-109619?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. The GitHub advisory lists releases before these versions as affected.
Does turning off session upload progress fix it?
No. PHP says session.upload_progress.enabled=0 with every worker restarted blocks the confirmed session path but not other variants. On PHP 8.5, fatal_error_backtraces=0 blocks only the confirmed backtrace path.
How does it differ from CVE-2026-109618?
CVE-2026-109619 comes from request state that outlives its memory. CVE-2026-109618 comes from out-of-memory handling that leaves request data invalid. See the CVE-2026-109618 page.
Sources
- Security advisory: Critical remote code execution vulnerabilities, update now (21 October 2026)PHP.net
- RCE via stale global stateGitHub
- PHP 8.5.12 Released! (21 October 2026)PHP.net
- PHP2Shell: Exploitation Attempts and Remediation Trends (27 October 2026)Wiz Research
- Security Advisory 2026-018: Critical Vulnerabilities in PHPCERT-EU
- php2shell: operational informationNCSC-NL
- Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619Sansec
- Known Exploited Vulnerabilities catalog: CVE-2026-109619 (added 26 October 2026)CISA
