PHP has released emergency security updates to address two critical vulnerabilities that can allow attackers to execute code remotely without authentication. Known as PHP2Shell, the flaws require action from hosting providers and server administrators, including those responsible for WordPress websites.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry a critical severity rating of 9.2 out of 10 under CVSS v4.0. PHP published the fixes on October 21, 2026, following an advance warning issued the previous day.
What makes these vulnerabilities dangerous?
The first flaw, CVE-2026-109618, involves PHP’s handling of out-of-memory errors. Under certain conditions, an interrupted operation can leave internal request data in an invalid state. Processing that data during request cleanup can lead to remote code execution.
PHP’s advisory confirms successful exploitation against Apache’s mod_php using default PHP input and memory limits. In this scenario, an attack can occur before the website’s application code begins running. Successful exploitation gives the attacker the permissions of the web worker account.
The second flaw, CVE-2026-109619, concerns internal state that survives after the memory associated with a request has been freed. A subsequent request handled by the same worker can access that stale state, potentially enabling code execution. The precise attack conditions depend on the PHP version, configuration and application behaviour.
Which PHP versions contain the fixes?
The PHP project has released the following security updates:
| PHP branch | Patched version |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Administrators should install the appropriate release or their operating system vendor’s patched package. PHP 8.1 and older no longer receive regular upstream updates, although some distributions and long-term support vendors provide backported fixes.
Why WordPress updates alone are insufficient
WordPress relies on PHP to execute its core software, themes and plugins. Updating those components remains essential, but PHP itself is part of the server environment and requires a separate update.
On shared hosting, PHP security patches are generally deployed by the hosting provider. Administrators of their own servers or container environments must ensure that the PHP installations serving their websites receive the fixes.
Configuration changes do not replace patching
PHP’s security advisory stresses that an update is the only complete solution. Temporary configuration changes can reduce exposure to particular attack paths, but they do not make an unpatched installation safe.
For example, disabling Session Upload Progress can block demonstrated session-related paths associated with CVE-2026-109619. However, it does not address other vulnerable paths. The setting must take effect before request parsing, and workers must be restarted; changing it within application code is insufficient.