Executive Summary
In October 2026, the PHP project released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (collectively known as PHP2Shell), which allow unauthenticated remote code execution (RCE). These flaws, carrying a CVSS v4.0 score of 9.2, affect almost all PHP installations serving web requests, including PHP-FPM and Apache mod_php. The vulnerabilities were discovered using AI-assisted research and were exploited four days prior to public disclosure while still under embargo.
Technical analysis reveals two distinct vectors: memory corruption via out-of-memory (OOM) handling during multipart request parsing (CVE-2026-109618) and a heap use-after-free vulnerability involving stale global state in the session upload progress path (CVE-2026-109619). Exploitation occurs at the engine level before any application-layer code or authentication can execute, making it highly dangerous for exposed servers.
While broad scanning and exploitation attempts have been observed by Amazon MadPot and other honeypots, mass successful breaches of production systems remain unconfirmed as of late October 2026. However, the availability of weaponized exploits that bypass ASLR on x86-64 platforms poses a severe risk. Organizations running end-of-life (EOL) PHP versions (8.1 and earlier) are particularly vulnerable as they will not receive upstream security updates.