The PHP team released emergency updates on October 21, 2026, for two critical vulnerabilities collectively known as PHP2Shell. Under the conditions described by researchers, the flaws allow unauthenticated remote code execution and access to information in server memory. The disclosure was accompanied by precautionary restrictions on some public online services in Germany and the deployment of additional protections by infrastructure providers.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, each carrying a CVSS 4.0 severity score of 9.2 out of 10. They reside in the engine that executes PHP on the server. Infrastructure operators and hosting providers are responsible for applying updates, depending on who manages the environment in which a website runs.
Services temporarily withdrawn from public access
The German city of Rösrath announced on October 21 that its service portal and online appointment system had been temporarily taken offline by its external provider as a precaution. The municipality's main website remained available. The city said the affected services would return once the vulnerabilities had been addressed and the systems checked.
Heinrich Heine University Düsseldorf restricted access to websites and applications hosted within its own network. Outside the campus, restricted services could be reached through the university's VPN connection with multifactor authentication. The institution described a precautionary measure to protect data, with services being reopened individually after updates or confirmation that they were unaffected. These announcements document interruptions deliberately introduced by operators to secure their services, without announcing that the systems concerned had been compromised.
Two errors in PHP memory management
The first vulnerability, CVE-2026-109618, concerns the handling of situations in which PHP runs out of the memory needed to process a request. Execution can be interrupted before certain internal structures have been fully initialized. During request shutdown, the engine then uses those structures as though they contained valid data. The technical advisory confirms code execution over HTTP against Apache with mod_php, using the privileges of the account running the web worker process.
The second flaw, CVE-2026-109619, arises when a PHP process retains references to memory belonging to a request that has already ended. A subsequent request handled by the same process can use the remaining information before normal initialization resets it. The advisory records exploitation of session mechanisms in both mod_php and PHP-FPM. Configuration, extensions and application operations determine the specific exploitation path.
PHP identifies installations serving web requests through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as being within the scope of the risk. The team considers mod_php to present the highest risk, with a demonstrated attack that can begin before application code executes. The fact that the PHP engine is affected explains why the issue concerns multiple content management platforms rather than a single product or plugin.
Patched releases are available
The announced security releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, covering the four maintained branches. According to Google Cloud, affected versions extend back to the PHP 5.4 series. Version numbers need to be considered alongside information from the distributor: Linux distributions and long-term support vendors received the patches in advance so they could prepare their own updated packages.
PHP 8.1 and earlier versions have reached the end of the project's regular support. However, the PHP team has provided minimal source-level backports for PHP 7.4, 8.0 and 8.1, intended for those compiling the software or working with specialist vendors. The availability of these source changes does not amount to a new, complete official release for each older branch.
Plesk has also announced patched packages for maintained PHP branches and for Linux versions 7.4.33, 8.0.30 and 8.1.34. For those three older versions, the provider retains the version number and distinguishes the fixed package by its build date, October 21, 2026. Checking the installed package therefore includes checking its build information in this particular case.
Tests on established platforms and attempts observed in network traffic
Wiz Research reported demonstrations of unauthenticated code execution on WordPress, Drupal and Joomla installations, using the container images available at the time of testing. The researchers separately demonstrated reading data from PHP process memory, including passwords, tokens and API keys. These are results from tests described by the team, separate from any count of websites compromised in actual attacks.
Amazon Threat Intelligence reported an exploitation attempt recorded on October 17 by its MadPot sensor network, four days before public disclosure. The company also observed further attempts on the morning of October 21 and the rapid use of exploitation demonstrations after publication. Amazon recommends investigating logs from at least October 17, including checking for unexpected processes and file changes on web application servers.
Additional protections in hosting infrastructure
Cloudflare says it automatically activated protections for customers using its web application firewall, including the free plan, on October 21 from 03:02 UTC. The company reported attack traffic and changes to requests designed to attempt to bypass its filters. The new detections correlate request information with the server's response and can block a response identified as dangerous before it reaches the requester.
Google Cloud said its platform infrastructure is not vulnerable, while PHP applications hosted by customers may require action. Automatic updating depends on the service and its configuration: eligible App Engine Standard applications receive updates, while custom container images must be rebuilt and redeployed with patched PHP. For Cloud Run, the company distinguishes services with automatic base image updates enabled from those requiring rebuilding and redeployment.
The patch release was brought forward by one day
The PHP Foundation explained that the vulnerability identifiers began circulating publicly on October 20, ahead of the coordinated schedule. The project moved the release from October 22 at 14:00 UTC to October 21 at the same time, equivalent to 17:00 in Romania. The foundation also described the accidental publication of a demonstration video, which added pressure to the process of distributing the patches.
Complete remediation requires updating the PHP engine actually used by the application. Cloudflare states that updating website code or plugins alone does not fix these vulnerabilities. Within website maintenance, the work therefore also concerns the server environment, separately from content management platform updates. The traffic filters and temporary restrictions described by providers supplement the installation of patched releases.
