Critical PHP Security Vulnerabilities in October 2026: What Website Owners Should Know

What actually happened

On 21 October 2026, the PHP project shipped an emergency security release fixing two critical vulnerabilities: CVE-2026-109618, a memory corruption issue triggered during out-of-memory handling, and CVE-2026-109619, where request-owned internal state can outlive its freed memory and get reused by a later request on the same worker. Both are rated 9.2 on CVSS v4.0. Details leaked publicly about a day ahead of the planned disclosure, which is why the issue has been widely covered in security press under the shorthand name "PHP2Shell" — that's a press nickname, not an official CVE name.

Which PHP versions are affected

PHP versions before 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are affected. Those four releases, shipped the same day as the advisory, contain the fix. PHP 8.1 and earlier are past official support from the PHP project; the security team published minimal source backports for 7.4, 8.0 and 8.1 only, meaning no official fix exists for anything older than that unless your distribution or hosting provider maintains its own backport.

• PHP 8.5 — fixed in 8.5.12
• PHP 8.4 — fixed in 8.4.27
• PHP 8.3 — fixed in 8.3.36
• PHP 8.2 — fixed in 8.2.35
• PHP 8.1, 8.0, 7.4 — minimal source backports only, no full official fix
• PHP 7.3 and earlier — no fix, long past end of life

Why this matters even if you haven't touched PHP directly

This is a vulnerability in the PHP runtime itself, not in any framework or CMS built on top of it. Updating Laravel, WordPress, CodeIgniter, or any other application layer does not patch PHP underneath it — the two have to be updated separately. PHP's own advisory states that any installation serving web requests is potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php carrying the highest risk since an exploit there can fire before your application code even runs.

"Remote code execution" means that, under the right conditions, an attacker can get your server to run commands of their choosing without needing a password or an account on your site. It's the most severe class of web vulnerability there is, which is why this got an emergency out-of-cycle release rather than waiting for PHP's regular monthly patch cycle.

How to check your own exposure

Start by finding out exactly which PHP version your server is actually running — not the version your framework targets, and not the version listed in a composer.json constraint, but the real runtime version. Most hosting control panels show this, or you can run `php -v` on the server directly.

php -v

We've put together a free PHP version checker that compares a version number against this advisory's fixed releases and tells you plainly whether you're below the fix, at or above it, or on an end-of-life branch that needs a manual review. It doesn't scan your site or probe your server — you enter the version yourself, and nothing is sent anywhere until you choose to request an assessment.

What to do next

• If you manage your own server: update PHP to the fixed release for your branch as soon as you can test it safely.
• If you're on managed hosting: check whether your host patches PHP centrally, and if not, update it yourself or ask them to.
• Either way, test before and after: PHP version upgrades can break applications relying on deprecated functions, old extensions, or outdated dependencies, so a rushed, untested update carries its own risk.
• If you're not sure where to start, a short professional review is usually faster than guessing.

We cover the full advisory in more technical depth, including an interactive version checker and official source links, on our PHP security vulnerability page. If you'd rather make PHP patching someone else's problem going forward rather than a once-a-year scramble, our PHP security update service covers ongoing version upgrades, patch management, and compatibility testing for Laravel, CodeIgniter, WordPress and custom PHP applications. You can also request a free PHP security assessment directly and we'll review your environment.