Critical flaws strike PHP as disclosure embargo is broken

The maintainers of the PHP general purpose scripting language are telling users to update their systems with patches for two critical vulnerabilities.

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. and PHP rates them as 9.2 out of 10 possible in terms of severity.

They can allow for unauthenticated remote code execution (RCE), and a working exploit is available.

Security vendor Hadrian nicknamed the vulnerabilities PHP2Shell and said it is seeing them "exploited in the wild at scale".

CVE-2026-109618, allows for RCE through out-of-memory (OOM) corruption, PHP said.

PHP can leave memory in a corrupted state when a request runs out of memory, and a crafted upload request can exploit this to run an attacker’s code on the server.

The other, CVE-2026-109619, abuses that PHP can leave behind a pointer to freed memory when a web request crashes.

A follow-up request handled by the same worker can then use that leftover pointer to again run attack code on the server.

Although the attack complexity is rated as high, with precise manipulation of a server's memory required, researchers have already demonstrated working exploits against Apache servers running default PHP settings.

Every PHP release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 is vulnerable.

There are partial workarounds for those unable to update straight away, but the maintainers said only the patched releases close the holes fully.

The PHP project said all installations serving web requests were at risk, naming PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

“We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs,” the project said.

The flaws were found by Ryan Austin of security firm Calif, working with OpenAI and Wiz, who said they had confirmed unauthenticated remote code execution against WordPress, Drupal, Joomla, Magento and other widely used applications.

Vulnerabilities break cover

News of the vulnerabilities broke early, before the embargo on them had expired.

A poster on the Hacker News site claimed two remote code execution vulnerabilities, or RCEs, in PHP would be announced on October 22 AEST, citing unnamed sources but quoting the CVE numbers.

Just hours after the existence of the two vulnerabilities surfaced on social media, a researcher posted the alleged full details of the vulnerabilities on the web, including two proofs of concept (PoCs).

iTnews has sighted the website but has not had independent confirmation that the PoCs are working ones.

On Wednesday, the Australian Signals Directorate (ASD) issued an unusual pre-patch alert about the vulnerabilities, urging administrators to monitor their PHP applications to be ready to update.

❗ ALERT ❗ We are aware of media reporting about critical vulnerabilities in PHP that may affect all versions from PHP 5 onwards. Organisations and individuals should monitor PHP applications and prepare to update and apply patches. Read the full alert �� https://t.co/XNcE4W0Wtj https://t.co/Zwqndc3iHu

— Australian Signals Directorate (@ASDGovAu) October 21, 2026

In Europe, CERT-EU, the cyber security service for EU institutions, issued an advisory telling organisations to prepare for immediate patching.

Where patching isn’t feasible, CERT-EU said organisations should “consider isolating internet-facing applications from public networks until a fix is available”.

PHP powers very popular server-side web applications such as the WordPress and Drupal content management systems, and the Magento ecommerce platform, running on millions of sites worldwide.