What Is PHP2Shell? CVE-2026-109618 & CVE-2026-109619 Explained

PHP2Shell is the nickname security researchers gave to a pair of critical vulnerabilities in the core of PHP itself: CVE-2026-109618 and CVE-2026-109619. They were disclosed on 21 October 2026, both carry a CVSS v4.0 score of 9.2 (Critical), and together they allow unauthenticated remote code execution — an attacker can run their own code on your server without logging in.

Because the bugs live in the PHP engine, not in any single application, they affect almost everything built with PHP: WordPress, Magento, Drupal, Joomla, Laravel, Symfony, phpMyAdmin, Nextcloud, Roundcube, custom apps — all of it.

The two vulnerabilities

• CVE-2026-109618 — “RCE via OOM corruption.” When a request runs out of memory, PHP's early-exit path can leave request memory in an invalid, half-initialized state. Later code reads that corrupted memory, which an attacker can steer toward code execution. Apache mod_php is the confirmed-exploitable case.
• CVE-2026-109619 — “RCE via stale global state.” Request-owned global data (error, session and extension state) can survive inside a reused worker process after its memory has been freed. Early operations on the next request read that freed memory — a classic use-after-free that can be turned into code execution.

How an attack works

Both bugs share a trigger: a fatal error during a request — most easily an out-of-memory condition when a request exceeds memory_limit — interrupts PHP's native code before it finishes cleaning up. A reused worker then treats freed memory as if it were live.

Attackers reach this through multipart/form-data requests, which PHP parses before your application code ever runs. No login is needed. Researchers also showed that the flaw can leak worker memory back in the PHPSESSID response cookie — and that leaked memory can contain passwords, session tokens, API keys and even TLS private keys from other visitors' requests. The leak works even if your app never calls session_start().

Which PHP versions are affected?

The vulnerable code dates back to PHP 5.4, so effectively every PHP release from the last decade is affected by at least one of the two bugs. Official fixes were released only for supported branches:

PHP 8.1 and older are end-of-life and received no official fix. If you run one of those, you must upgrade to a supported branch (or ask your host to backport the patch).

What you should do now

1. Find your PHP version. Use our free scanner, or run php -v on the server.
2. Update PHP to one of the patched versions. See How to fix PHP2Shell.
3. If you can't patch immediately, apply temporary mitigations.