PHP2Shell: Patch Your PHP Now — Two Critical RCE Flaws Under Active Attack

On 20 October 2026, technical details of two unpatched remote code execution (RCE) vulnerabilities in the PHP interpreter leaked online — ahead of their coordinated disclosure and before any fix existed. The PHP project shipped emergency patches the next day, 21 October 2026. Together the two flaws are being tracked under the nickname PHP2Shell.

Both carry a CVSS v4.0 base score of 9.2 (Critical), and both allow an unauthenticated attacker to execute their own code on a vulnerable server. Within hours of the patches landing, exploitation was observed at scale across the internet, concentrated on PHP’s session upload-progress path. Because PHP runs a very large share of the world’s websites, several public-sector and media organisations pre-emptively took sites offline while they arranged emergency fixes — a precaution that, by itself, does not mean those sites were breached.

If you operate anything that runs PHP — a CMS, a bespoke app, an internal tool, a container image — this advisory is about you until you have confirmed otherwise.

Both vulnerabilities are use-after-free bugs: the engine keeps using a piece of memory after it has been freed, so stale data (or attacker-controlled data) survives into a later request handled by the same worker process. That is the root of both remote memory disclosure and remote code execution.

• CVE-2026-109618 — upload-progress unserializer use-after-free. A flaw in PHP’s session upload progress deserialization path leads to a use-after-free that both leaks server memory (potentially exposing passwords, session tokens and API keys from other requests) and enables remote code execution. This is the path attackers are hitting first and hardest.
• CVE-2026-109619 — fatal-error backtrace use-after-free + OPcache type confusion. A use-after-free triggered while building a fatal-error backtrace, combined with a type-confusion weakness in OPcache, gives an attacker a route to remote code execution.

“Remote code execution with no authentication” is as bad as it sounds: a successful exploit lets an attacker run commands as your web server — plant a web shell, read your database credentials, pivot inward. The memory-disclosure half of CVE-2026-109618 is just as dangerous in a quieter way, because secrets read out of memory let an attacker walk straight back in even after you patch, if you don’t rotate them.