Critical Vulnerabilities in PHP (PHP2Shell)

Successful exploitation of CVE-2026-109618 and CVE-2026-109619 could allow an unauthenticated attacker to execute code remotely or access sensitive memory

Threat ID:: CC-4875
Threat Severity:: High
Published:: 21 October 2026 3:51 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-109618 and CVE-2026-109619 could allow an unauthenticated attacker to execute code remotely or access sensitive memory

Affected platforms

The following platforms are known to be affected:

PHP

All prior to 8.5.12
All prior to 8.4.27
All prior to 8.3.36
All prior to 8.2.35

Note: PHP 8.1 and older versions are affected, but are end-of-life (EOL) and no longer receive updates.

Threat details

Proof-of-concept exploit for CVE-2026-109618 and CVE-2026-109619

Security researchers have demonstrated successful exploits for both CVE-2026-109618 and CVE-2026-109619, achieving remote code execution in products integrating PHP such as WordPress, Drupal, and Joomla.

PHP is a widely used open-source, server-side scripting language used to support web applications and dynamic web content. Vulnerabilities affecting PHP may impact web servers and applications running affected versions, creating a significant attack surface and making these vulnerabilities highly attractive to attackers.

The NHS England National CSOC assesses future exploitation as highly likely.

Introduction

The PHP Foundation has released security advisories to address two critical vulnerabilities in PHP. Successful exploitation of the vulnerabilities could allow an unauthenticated attacker to perform remote code execution (RCE) or access sensitive data from PHP process memory.

CVE-2026-109618 - RCE via out-of-memory corruption vulnerability - CVSSv4 Score: 9.2
CVE-2026-109619 - RCE via stale global state vulnerability - CVSSv4 Score: 9.2

Remediation advice

Affected organisations must review the PHP security advisory released on 21 October 2026, and complete the remediation steps detailed below.

Remediation steps

Type	Step
Patch	Required: Patch to a fixed version Affected organisations must patch their PHP instances to a fixed, supported version: 8.5.12 or later 8.4.27 or later 8.3.36 or later 8.2.35 or later Note: PHP versions 8.1 and older are vulnerable, end-of-life, and no longer supported. Organisations must migrate to a supported release. https://www.php.net/archive/2026.php#2026-10-21-5
Guidance	Temporary mitigation: Take vulnerable devices offline until a patch can be applied Updating to a PHP release containing the patch for these vulnerabilities is the only complete remediation. If affected organisations cannot apply the patch immediately, they must conduct a local risk assessment and should consider taking vulnerable devices offline until they are patched. https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

Type

Step

Patch

Required: Patch to a fixed version

Affected organisations must patch their PHP instances to a fixed, supported version:

8.5.12 or later
8.4.27 or later
8.3.36 or later
8.2.35 or later

Note: PHP versions 8.1 and older are vulnerable, end-of-life, and no longer supported. Organisations must migrate to a supported release.

https://www.php.net/archive/2026.php#2026-10-21-5

Guidance

Temporary mitigation: Take vulnerable devices offline until a patch can be applied

Updating to a PHP release containing the patch for these vulnerabilities is the only complete remediation. If affected organisations cannot apply the patch immediately, they must conduct a local risk assessment and should consider taking vulnerable devices offline until they are patched.

https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Status Published

CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Last edited: 21 October 2026 3:51 pm