Critical PHP RCE Flaws: CVE-2026-109618 & 109619 Patched

On October 21, 2026, the PHP development team released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical vulnerabilities collectively tracked in the security community as “php2shell”: CVE-2026-109618 and CVE-2026-109619. Both flaws can allow unauthenticated remote code execution (RCE) on internet-facing PHP servers. The core message from PHP’s maintainers is unambiguous: upgrading the PHP runtime is the only complete remediation.

Because PHP powers roughly 70 percent of websites using a known server-side language, the coordinated release triggered immediate advisories from national and regional computer emergency response teams, including CERT-EU (Security Advisory 2026-018) and the Dutch National Cyber Security Centre (NCSC-NL). Across Europe and globally, numerous public-sector portals and enterprise web services temporarily placed their sites into maintenance mode while administrators deployed the patched builds.

Premature CVE leak, discovery timeline, and technical root cause

According to The PHP Foundation’s technical post-mortem, the underlying out-of-memory (OOM) handling behavior behind CVE-2026-109618 was first noted during a 2024 external security audit funded by the Sovereign Tech Agency and conducted by OSTIF and Quarkslab. At the time, exploitation appeared purely theoretical and proposed changes risked breaking backward compatibility and third-party extensions. That assessment changed after PHP joined the Patch the Planet initiative in late July 2026: on August 11, 2026, researcher Ryan Austin of Calif (led by CEO Thai Duong) demonstrated an unconditional remote code execution path using AI-assisted source analysis and reported it to PHP Foundation security engineer Volker Dusch. OpenAI independently reported the same root cause the same day, followed by additional exploitation vectors from Wiz on August 24 and OpenAI on September 18.

The coordinated disclosure timeline was disrupted roughly 24 hours before the scheduled patch release. Around 15:00 UTC on October 20, both CVE identifiers and their descriptive titles leaked into public vulnerability feeds before fixed packages were available. That premature leak prompted CERT-EU and NCSC-NL to issue urgent guidance. Importantly, the wave of offline websites observed on October 20 and 21 resulted from precautionary shutdowns by system administrators awaiting the patch, rather than confirmed mass destructive outages.

Technically, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w, NVD) stems from improper cleanup when an out-of-memory condition occurs while PHP is still parsing incoming request data (CWE-119, CWE-787), leaving partially initialized structures in memory that can be leveraged for remote code execution. CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp, NVD) is a use-after-free vulnerability (CWE-416) where internal state from session upload progress or fatal error backtraces persists after request memory has been freed. PHP scores both vulnerabilities at 9.2 (Critical) under CVSS v4.0, while NIST NVD assigns 9.8 (Critical) under CVSS v3.1.

Affected server configurations and patched versions

PHP’s advisory warns that every PHP installation serving web requests is at risk, including PHP-FPM, Apache mod_php, php.exe, CGI/FastCGI, and persistent worker runtimes such as FrankenPHP, RoadRunner, and Swoole. The highest exposure occurs in Apache mod_php deployments, where worker threads share the same address space across requests.

Administrators running PHP-FPM must not assume they are safe. Although PHP-FPM isolates worker processes more effectively against CVE-2026-109618, the session upload progress vector in CVE-2026-109619 is enabled by default and can be triggered on standard FPM deployments without requiring any custom application script. Researchers verified full remote code execution against both mod_php and PHP-FPM. As Tenable’s threat analysis notes, because FPM’s master process automatically respawns crashed worker processes, a service that remains online may still be experiencing active exploitation attempts; Tenable also warns defenders to avoid trojanized “php2shell PoC” repositories on GitHub that distribute infostealer malware.

Official patched releases for supported branches are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. Given the severity of the flaws, the PHP security team also published minimal source-level patch branches for end-of-life versions PHP 7.4, 8.0, and 8.1. On Linux distributions such as Debian and Ubuntu, security fixes are backported into existing distribution package trees—meaning administrators must verify the installed distribution package version against official distro advisories rather than relying solely on php -v (Debian Security Tracker, Ubuntu Security).

Remediation checklist and temporary hardening measures

1. Inventory all web-facing PHP runtimes: Identify every PHP deployment handling external or internal HTTP traffic—including FPM pools, Apache mod_php, container images, and FrankenPHP/RoadRunner/Swoole workers—and remove any publicly reachable phpinfo() diagnostic pages that expose configuration state.

2. Apply updates and restart worker processes: Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or your Linux distribution’s patched package build) and restart both the web server and all PHP-FPM or persistent application worker processes so no unpatched binary remains resident in memory.

3. Apply temporary configuration mitigations only until patched: PHP emphasizes that configuration changes only narrow specific attack paths and do not make an unpatched server safe. If immediate patching is impossible, CVE-2026-109618 exposure can be reduced by setting memory_limit=-1 via php_admin_value (so scripts cannot override it via ini_set() or .user.ini) and lowering post_max_size and upload_max_filesize—while ensuring no OS-level RLIMIT_AS or RLIMIT_DATA cap is set on PHP workers, which would trigger out-of-memory faults earlier. For CVE-2026-109619, set session.upload_progress.enabled=0 and (on PHP 8.5) fatal_error_backtraces=0, keeping in mind that the @ error-suppression operator can still generate internal error structures even when error_reporting and display_errors are disabled.

4. Audit process crash and error logs: Inspect FPM and web server error logs for repeated worker crashes (SIGSEGV or out-of-memory terminations), anomalous multipart POST bodies, and unexpected upload-progress session activity. Clean HTTP access logs alone do not prove a server was untouched, as requests that crash a worker mid-parse are not always recorded in standard access logs.

LeakData perspective: Protecting your credentials and data after web server vulnerabilities

First, a note of assurance for our users and partners: LeakData’s platform and services are not affected by CVE-2026-109618 or CVE-2026-109619. Following the global advisories, our security team reviewed all external perimeter controls and confirmed our environment remains fully protected. For the broader internet ecosystem, however, the primary danger of critical RCE flaws like php2shell extends well beyond the initial server compromise into post-exploitation credential and data theft.

When threat actors achieve remote code execution on an unpatched web application server, their immediate objective is typically harvesting environment configuration files, database connection strings, API secrets, active session tokens, and user account tables. Even after an engineering team patches its PHP runtime, credentials and customer records exfiltrated during the exposure window frequently surface days or weeks later across stealer logs, Telegram channels, and underground breach forums.

LeakData helps individuals and security teams close that visibility gap. Once you have patched your servers, you can use LeakData to check whether corporate email addresses, administrative accounts, or user credentials associated with your domain appear in newly discovered breach datasets, and enable continuous domain and identity monitoring to receive immediate alerts if compromised credentials surface—allowing your team to enforce rapid password resets and key rotation. Learn more about how our continuous monitoring works on our How It Works page.