PHP2Shell: Critical PHP Vulnerabilities in October 2026
Critical PHP vulnerabilities disclosed in October 2026 require attention from organizations running PHP-powered websites, APIs, and applications. CVE-2026-109618 and CVE-2026-109619 can enable unauthenticated remote code execution in affected web runtimes. Fixed upstream releases became available on 21 October 2026. A further issue, CVE-2026-115560, was reported separately. Organizations should assess their runtime versions, deployment configurations, vendor guidance, and possible signs of compromise.
What is PHP2Shell?
PHP2Shell is the name commonly used for the two critical PHP runtime vulnerabilities disclosed in October 2026.
CVE-2026-109618 involves improper handling of out-of-memory conditions.
CVE-2026-109619 involves the use of stale internal request state.
Under vulnerable conditions, these flaws can allow remote attackers to execute code without authentication.
Which PHP versions are affected?
| PHP branch | First fixed release for the original two vulnerabilities |
|---|---|
| PHP 8.5 | PHP 8.5.12 |
| PHP 8.4 | PHP 8.4.27 |
| PHP 8.3 | PHP 8.3.36 |
| PHP 8.2 | PHP 8.2.35 |
| PHP 8.1 and older | No upstream fix; follow verified vendor-specific guidance or move to a supported branch |
Does the 21 October PHP update address every reported vulnerability?
No. The 21 October releases address CVE-2026-109618 and CVE-2026-109619. The subsequent disclosure of CVE-2026-115560 concerns a distinct issue associated with particular session configuration and application behavior. It was not covered by those releases. Organizations should consult the PHP security team's current guidance and their hosting vendor before determining whether additional corrective action is required.
Does the issue affect Laravel or WordPress?
Applications built using Laravel, WordPress, or custom PHP code may run on affected PHP runtimes.
The issue exists in PHP itself. Updating the application framework or content management system alone does not establish that the underlying PHP runtime has been patched.
Organizations should inspect the actual runtime used to serve their applications.
What should organizations do?
First, identify all PHP applications and the runtime versions serving requests. Check internet-facing systems as a priority.
Next, review the hosting environment, dependencies, available vendor updates, and application compatibility.
Apply appropriate fixes using a controlled deployment and validation process. Where compromise is suspected, review relevant logs and involve qualified incident responders.
Should you move away from PHP?
The vulnerabilities create an urgent patching requirement. They do not automatically mean that every PHP application should be rewritten in another language.
A supported, updated PHP stack may continue to meet the business's needs.
Migration becomes relevant when the existing application also faces architectural limitations, unsupported frameworks, maintainability challenges, integration problems, or a wider technology strategy change.
How dC0dez can help
dC0dez provides PHP runtime assessment, patch and upgrade planning, application compatibility review, PHP modernization, and technology migration services.
We can also help define an ongoing maintenance scope to reduce the risk associated with neglected updates and aging dependencies.
Need help assessing your PHP environment?