php2shell: two critical flaws in PHP itself, attacked before the fix

On 17 October, a honeypot run by Amazon picked up an attack on a flaw in PHP that had no public name and no fix. Four days later, on 21 October 2026, the PHP project released emergency updates for two vulnerabilities that together are now called php2shell.

Update now: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35

PHP runs the server side of about seven in ten websites whose language is known, including most WordPress sites. These flaws are in the PHP engine itself, so updating WordPress, plugins or the site's own code does not help.

What is wrong?

Both flaws let an attacker who is not logged in run their own code on the server, with the rights of the web server process. PHP rates both at 9.2 out of 10 (CVSS 4.0), according to its security advisory.

• CVE-2026-109618: when PHP runs out of memory while a request is only half set up, the clean-up can trust that half-built data.
• CVE-2026-109619: leftover state from one request points to freed memory that the next request on the same worker can reach.

Every way of serving PHP to the web is affected: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, as Tenable's summary lists them. The oldest affected code dates back to PHP 5.4.

Is it being exploited?

Yes, attempts are confirmed. Amazon Threat Intelligence saw the first on 17 October and more from several actors on 21 October. Cloudflare and watchTowr also report attacks. Whether the attempts succeed is not yet known, and the PHP Foundation said it had found no working public exploit at release. Code claiming to be one circulates and may itself contain malware.

The release was moved forward from 22 October because the CVE numbers leaked early.

What should site owners do?

1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your hosting provider's or Linux distribution's patched package, then restart every PHP worker.
2. Older versions: PHP 7.4 to 8.1 get only source patches, and 5.4 to 7.3 get nothing. Move to a supported branch. PHP 8.2 itself ends on 31 December 2026.
3. If you cannot update today: set memory_limit=-1 so applications cannot override it, and session.upload_progress.enabled=0 (on PHP 8.5 also fatal_error_backtraces=0), then restart. These are stopgaps, not fixes, as Datadog Security Labs stresses.
4. Look back to 17 October: very large form submissions with field names of megabytes, memory errors at "Unknown on line 0", crashed Apache children, and above all a web server process starting a shell.

What we do not know yet

How many servers have been broken into, and whether a reliable public exploit exists. Estimates of exposed PHP hosts run from 1.3 to over 1.9 million. This article is current as of 22 October 2026 and will not track later reports.

ARMSMA's own sites, armsma.org and Nocton, do not run PHP. Our free vulnerability tracker lists flaws attackers already use, and the domain check shows what your own site exposes.