PHP releases urgent fixes for two severe remote code execution bugs
The PHP project has issued emergency updates for two critical vulnerabilities that allow unauthenticated attackers to run code remotely. The flaws affect common PHP deployment setups, with mod_php considered especially risky because exploitation can occur before application code executes. Administrators are advised to upgrade to the latest fixed PHP 8.x releases, while older branches require vendor backports or migration.
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and jointly called PHP2Shell, were found by researchers from Calif, Wiz, and OpenAI. They affect web-serving PHP setups such as PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Both arise when an abnormal request shutdown leaves PHP memory corrupted.
The PHP team rated mod_php as most dangerous because an unauthenticated request can exploit it before an application’s own code executes. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; older branches need vendor backports or migration. Cloudflare reported early attack attempts, while the UK NCSC urged immediate patching or taking systems offline.
The impact could be broad because PHP underpins many websites and web services, so unpatched servers may expose organizations and their users to remote code execution. Hosting providers, e-commerce sites, and public-sector services may face urgent maintenance windows, while smaller operators could struggle to patch quickly. Temporary WAF rules and configuration changes may reduce some risk, but they are not complete defenses. The incident may reinforce pressure to track supported software versions and maintain rapid update processes.