PHP releases fixes for two 9.2-severity RCE flaws

The PHP development team released security updates on October 21, 2026, fixing two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 and known collectively as PHP2Shell. Both flaws carry a CVSS 4.0 severity score of 9.2, and the team urged immediate patching.

The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CVE-2026-109618 occurs while handling out-of-memory errors during request shutdown and can lead to remote code execution; the PHP team verified unauthenticated code execution via HTTP requests in a standard mod_php configuration, before web application code runs.

The second flaw, CVE-2026-109619, involves stale internal state remaining after request memory is freed, which a worker process can reference when handling a later request. Affected environments listed include PHP-FPM, Apache mod_php, PHP-CGI, FrankenPHP and LiteSpeed, with mod_php rated the highest risk.

Verifying the patch

Running php -v alone is not sufficient to confirm patching, since the web service may use a different PHP-FPM or Apache module version. Ubuntu 24.04 LTS lists the patched package as 8.3.6-0ubuntu0.24.04.13.

Setting session.upload_progress.enabled=0 blocks some attack paths but not all variants, and fatal_error_backtraces=0 in PHP 8.5 is only a limited mitigation. The details were reported by dailysecu.com.