Two critical, CVSS v4.0 9.2 flaws in PHP core allow unauthenticated remote code execution on almost any PHP site. Patches shipped 21 October 2026 - here is what UK businesses need to know and do next.
Both CVE-2026-109618 and CVE-2026-109619 let an attacker run code on a PHP server with no login and no valid credentials needed.
The bug sits in PHP core itself, so it is application-agnostic - Wiz demonstrated it against plain PHP, and against the latest WordPress, Drupal and Joomla images alike.
Fixed versions are out for every supported PHP branch. Older, end-of-life versions need a backport or an upgrade instead.
PHP2Shell is the name given to two critical bugs in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (Critical) under CVSS v4.0. Both allow unauthenticated remote code execution, and both can also disclose memory contents such as passwords, tokens and API keys. Because the flaw sits in PHP core rather than in any particular application, the exposure is unusually broad - Wiz, the security research firm that found the bugs, estimates PHP powers around 70% of the web.
The two CVEs are distinct bugs with a similar end result. CVE-2026-109618 is a use-after-free that Wiz describes as sitting in the upload-progress unserializer, triggered when out-of-memory handling interrupts PHP mid-request. CVE-2026-109619 is a separate use-after-free that Wiz traces to fatal-error backtrace handling, where stale internal state survives after its memory is freed. A public proof-of-concept exists for the underlying flaw, and early exploitation attempts have been reported by watchTowr, Cloudflare and VulnCheck.
Every PHP installation that serves web requests is potentially affected, across SAPIs including Apache mod_php (the highest risk, since code can execute before application logic even runs), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The bug is believed to go back roughly a decade, to around PHP 5.4. Because the flaw is application-agnostic, a WordPress, Drupal or Joomla site is exactly as exposed as a plain PHP page - see our dedicated WordPress PHP2Shell fix guidance if that's your platform.
The timeline moved fast. Wiz Research found the bugs on 19 August 2026 and reported them to the PHP security team on 24 August. Separately, researcher Ryan Austin at security firm Calif found a version of the flaw using OpenAI's GPT-5.6 Sol as part of OpenAI's "Patch the Planet" programme, with OpenAI finding a more complete version in September - both discoveries used AI models. The PHP security team gave advance notice of a 21 October 14:00 UTC release, but details leaked on a forum, forcing disclosure early. We covered the initial disclosure in our news piece on the critical PHP RCE vulnerability, and the fixed versions, EOL options and AI discovery story in our follow-up news piece.
Both CVEs are memory-safety bugs inside PHP's request handling, not flaws in any particular website or CMS. Understanding the mechanism helps explain why a simple application-level fix was never going to be enough.
Out-of-memory handling can interrupt PHP while internal request data is only partially initialised. Request cleanup then treats that invalid data as valid - Wiz describes it as an upload-progress unserializer use-after-free.
Request-owned internal state can survive after its backing memory is freed. A later request handled by the same worker may use that memory before normal initialisation resets it - Wiz describes it as a fatal-error backtrace use-after-free.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on 21 October 2026. PHP 8.1 and older are end-of-life and get no official release - minimal source backport branches exist for 7.4, 8.0 and 8.1, with nothing available for PHP 5.x. See our PHP upgrade service if you're on an EOL branch.
PHP's own advice is to upgrade immediately, stating plainly that "there are no complete mitigations". Config changes and the emergency WAF rules Cloudflare deployed on 21 October only reduce risk - they don't close the underlying hole.
We check what your web server is actually running. FPM or mod_php version can differ from the CLI's php -v, and a distro package can show an older-looking number that already carries a backported fix.
You get a written report that states plainly whether you're exposed, what's already mitigated, and what needs patching next - not a list of CVE numbers with no context attached.
You don't need to be a PHP expert to get a first read on where you stand - these are the steps we'd take ourselves.
Check php -v on the server and compare it with what your web server (Apache or FPM) actually runs - the CLI and web versions can differ.
Check your number against PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or confirm your distro or vendor has already shipped a backported fix under an older-looking number.
Set session.upload_progress.enabled = 0 and the memory and upload limits in php.ini or your FPM pool config, not via ini_set() or .user.ini, which don't take effect.
If you're not confident reading the output, we'll verify it for you and tell you plainly what, if anything, needs doing next.
As a London-based managed IT, web development and cyber security provider for UK SMEs, we look at exposure the way an attacker would, not just a version number sitting in isolation.
We check what your server is genuinely running, not what a changelog claims, because CLI and FPM versions can disagree, and a distro package can carry an unlabelled backport.
Because we also run vulnerability scans, we can look beyond the version number for other issues sitting alongside PHP2Shell on the same server.
If your platform turns out to be WordPress, Drupal or Joomla, we'll tell you plainly that the fix has to happen at the PHP layer, not inside the CMS admin screen.
If you're still running an end-of-life PHP version, we're upfront that mitigations alone won't fully solve it, and we'll point you toward a proper upgrade path rather than papering over the gap.
Reporting is written in plain English, so you know exactly what's exposed, what's mitigated, and what to prioritise, without needing to interpret a CVE write-up yourself.
We also support ongoing security through our wider IT support work, so a one-off PHP2Shell check can feed into a longer-term security posture rather than a single disconnected fix.
Every check is scoped to your platform and hosting setup - here's a rough guide to where most businesses land.
Version, SAPI and exposure review
Assess, plus config mitigation
Full patching, backport or upgrade, plus hardening
We treat PHP2Shell as a server-level problem, not a CMS one. Here's what sets our check apart.
We check what's genuinely running on your server, not just what a vendor changelog claims is fixed.
mod_php, PHP-FPM, php-cgi and more - real-world risk differs by configuration, not just by version number.
If you're on an unsupported PHP version, we say so plainly and point you to a proper upgrade path, not a patched-over gap.
Works equally on plain PHP, WordPress, Drupal, Joomla or a custom build, because the bug sits beneath all of them.
You deal with one person who understands your setup, not a rotating ticket queue.
Any mitigation we apply is set in php.ini or your FPM pool config, where it actually takes effect.
You keep full ownership of your code, server access and hosting account throughout.
A one-off exposure check doesn't commit you to anything ongoing unless you want it to.
A clear, written summary of what we found and what to do about it, with no unexplained jargon.
We deliver PHP2Shell exposure checks to businesses across the UK remotely, so location doesn't change how thoroughly your server gets reviewed. Whether you're on shared hosting, a VPS or a managed platform, we scope the check to your actual setup rather than a generic scan. Because we also provide broader IT support, we can look at what sits around PHP too - hosting, firewalls and server configuration - rather than treating the vulnerability in isolation.
This matters because exploitation can leave traces outside PHP itself - a new admin account, an unfamiliar scheduled task, or a file that shouldn't be there. A check that only confirms a version number misses all of that, which is why we look at the server as a whole, not just the one component making headlines.
Businesses generally choose between three approaches once they hear about the PHP2Shell vulnerability, and it's worth being honest about the trade-offs of each.
Do nothing and hope it's covered: the cheapest option in the moment, but PHP's own advice is that there are no complete mitigations short of patching, and early exploitation attempts were already reported before fixes shipped.
Patch it yourself: works well with in-house capability and server access, though end-of-life PHP versions need a backport build rather than a simple update, and it's easy to check the CLI version while the live FPM pool stays unpatched.
Request an independent check: confirms exactly what you're running, what's already mitigated and what still needs attention, with a named contact if anything is unclear.
What to check before trusting a "fixed" status: whether the fix was verified against the web-facing SAPI, not just CLI, whether mitigation settings were placed in php.ini or the FPM pool rather than ini_set(), and whether anyone checked for compromise that may have happened before patching.
Coverage
We check PHP2Shell exposure for businesses across the UK remotely, with London-based on-site availability for businesses that want a face-to-face meeting.
php2shell vulnerability
Two critical, unauthenticated remote-code-execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
php security check uk
Remote-first PHP2Shell exposure checks delivered across the UK, with London-based on-site availability when it helps.
Got questions about the PHP2Shell vulnerability? We've answered the most common ones below. If you need more detail, get in touch.
PHP2Shell is the name given to two critical, CVSS 9.2 bugs in PHP core, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on almost any server running PHP.
CVE-2026-109618 is an out-of-memory corruption bug, described by Wiz as an upload-progress unserializer use-after-free. CVE-2026-109619 is a stale global state bug, described as a fatal-error backtrace use-after-free. Both reach unauthenticated RCE.
If your server runs PHP to serve web requests - via Apache mod_php, PHP-FPM, php-cgi, FrankenPHP or LiteSpeed - it's potentially affected, regardless of whether it runs WordPress, Drupal, Joomla or a custom build.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released 21 October 2026. If you're running an older supported branch, upgrading to one of these closes the hole.
These get no official release. Minimal source backport branches exist for 7.4, 8.0 and 8.1, or you can get backports from an LTS vendor or your Linux distribution, or upgrade to 8.2 or later. Nothing is available for PHP 5.x.
It was discovered independently by Calif, a security firm working with OpenAI's "Patch the Planet" programme, and by Wiz Research, both using AI models. Wiz noted that "a single researcher completed in a week what previously would have taken a world-class team months of work".
Look for unusual multipart requests followed by memory-limit errors or repeated 500s, oversized or malformed PHPSESSID cookies, unexplained worker churn, new admin users, unfamiliar files or cron jobs. Because exploitation preceded patching, check even if you're now patched.
Check your actual web-facing PHP version, upgrade to a fixed release if you can, apply the config mitigations if you can't upgrade immediately, and check for signs of compromise either way.
No. The bug is in PHP itself, so updating your CMS, theme or plugins doesn't touch it. See our WordPress PHP2Shell fix guidance for what WordPress site owners specifically need to check.
UK-based support for businesses checking their exposure to CVE-2026-109618 and CVE-2026-109619.
We believe that communication is key to any successful partnership. Submit your details and one of our friendly team members will be in touch with you shortly.
Submit your details and one of our friendly team members will be in touch with you shortly
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
22 Oct, 2026
Fixed wireless access delivers business internet over radio rather than a cable into the building, and for many UK businesses it is a genuine primary...
21 Oct, 2026
Row-level security reporting means building dashboards that show each person only the rows of data they are entitled to see their own region, their own team,...
20 Oct, 2026
Good LLM integration architecture is what separates an AI feature that keeps working for years from one that becomes a maintenance burden within months. The...