PHP2Shell Critical RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619

In October 2026, details regarding two critical remote code execution (RCE) vulnerabilities in the PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 (collectively dubbed 'php2shell'), were leaked online prior to the coordinated disclosure date. The vulnerabilities carry a CVSS v4.0 score of 9.2. Due to the high impact and widespread use of PHP across the internet (powering approximately 69% of known websites), the PHP security team moved up the emergency release window to October 21, 2026.

The flaws reside in PHP's session upload progress mechanism, specifically a heap use-after-free (UAF) condition within `php_session_rfc1867_callback`. Attackers can trigger this via crafted multipart POST requests, leading to arbitrary command execution on the host server. Early reports indicate that all major PHP branches (5.x, 7.x, and 8.x) are likely affected. As official patches are only expected for supported branches (8.2+), legacy and end-of-life (EOL) environments remain at severe risk.

Immediate action is required for organizations running PHP-based applications. Initial reports of in-the-wild exploitation have emerged, and traditional configuration workarounds—such as disabling `session.upload_progress.enabled`—have been confirmed by PHP core developers to be insufficient as standalone protections. Organizations must prioritize patching and consider isolating highly sensitive internet-facing PHP applications until updates are verified.