PHP2Shell: Critical Remote Code Execution in PHP

On October 21, 2026, the PHP project released emergency security updates to address two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), dubbed PHP2Shell. Both flaws carry a CVSS v4.0 score of 9.2 and allow unauthenticated remote code execution (RCE) on servers running PHP versions 8.2 through 8.5. The vulnerabilities affect a wide range of web environments including WordPress, Drupal, and Magento, with Apache's mod_php identified as the highest-risk configuration.

Technically, CVE-2026-109618 involves out-of-memory corruption during request initialization, while CVE-2026-109619 utilizes stale global state in persistent PHP workers to create a use-after-free condition. Early reports suggest that AI assistance has significantly accelerated the development of exploit components, reducing complex exploit chains to roughly one week of effort. Rapid weaponization is expected as attackers reverse-engineer the published patches.

These vulnerabilities represent a severe risk to internet-facing services. Successful exploitation can lead to full server compromise, data theft via memory leaks (including credentials and API keys), and long-term persistence. While patching closes the entry point, it does not remediate existing compromises or invalidate leaked credentials, requiring comprehensive incident response beyond simple updates.