PHP2Shell is the public name for two critical vulnerabilities in the PHP interpreter itself: CVE-2026-109618 and CVE-2026-109619. Reports describe them as allowing unauthenticated remote code execution and Heartbleed-style memory disclosure, regardless of which application runs on top of PHP.

The PHP security team announced a fix release on October 20, 2026, scheduled for October 21 at 14:00 UTC. This article summarises what has been reported so far, and what is still unclear.

What PHP2Shell Covers

Both flaws are rated critical, with a reported CVSS v4.0 score of 9.2 each. CVSS is the industry scoring scale for vulnerability severity, running from 0 to 10.

The important detail is where the bugs live. Most PHP security incidents come from a flaw in a specific application, such as a vulnerable plugin or a badly written form handler. Here the problem is reported to be in PHP core, so a site can be affected even if its own code is carefully written.

  • CVE-2026-109618 is described as an out-of-memory handling bug. It concerns how PHP behaves when it cannot allocate more memory.
  • CVE-2026-109619 is described as a use-after-free error. This happens when a program keeps using a block of memory after releasing it, which can let an attacker read or influence data that should be off limits.

The "Heartbleed-style" comparison refers to the 2014 OpenSSL bug that leaked process memory to remote attackers. The implication is that secrets held in memory, such as keys, session data or credentials, could be exposed. Remote code execution means an attacker could run their own commands on the server.

Why mod_php Is the Biggest Concern

Reporting says the risk is highest for mod_php, the Apache module that runs PHP inside the web server process. A demonstrated exploit showed an unauthenticated request triggering the attack before any application code ran. That means login pages, firewalls inside the application and framework-level protections would not get a chance to intervene.

An exploit tool also named PHP2Shell has been reported as available, along with a video guide showing it in use. Public tooling usually shortens the time between disclosure and mass scanning, so the window for patching is short.

A difficult disclosure period

Defenders had an awkward few days. Organizations were warned of critical vulnerabilities before official technical details and fixed versions were published, which left little to act on. According to reporting, the PHP Foundation moved the update forward by a day after the CVE identifiers leaked, which gave threat actors some idea of how to exploit the flaws.

Note that the reported dates differ slightly in how they describe the release timing: the October 20 announcement named October 21 as the release date. Check the official PHP release announcements for the exact current state.

What Operators Should Do and What Remains Unclear

The practical step is to move to the patched PHP release published by the PHP project or your distribution. I am not stating specific fixed version numbers because the source material does not supply them. Look them up in the official security announcement or your vendor's advisory.

A useful first step is to find out which PHP version you run and how PHP is attached to your web server. The commands below are for a Linux host with Apache; adjust them for your setup.

# PHP version and SAPI of the command-line binary
php -r 'echo PHP_VERSION, PHP_EOL, PHP_SAPI, PHP_EOL;'

# Is mod_php loaded into Apache?
apachectl -M 2>/dev/null | grep -i php

# Which PHP packages are installed (Debian/Ubuntu)
dpkg -l | grep -i php

Note that the command-line binary can differ from the one serving web requests. Confirm the version used by the web server as well, for example through a PHP info page that is not publicly accessible.

Some things are not yet clear from the material gathered:

  • The exact list of affected PHP branches and versions.
  • Whether PHP-FPM and other setups are exploitable, and how easily, compared with mod_php.
  • Whether any workaround exists short of upgrading.
  • How widely exploitation is occurring in practice.

Treat anything beyond the points above as unconfirmed until the official advisories say otherwise.

Conclusion

PHP2Shell is serious because it targets the runtime rather than an application, and because a public exploit tool has been reported. The CVSS 9.2 ratings, the pre-authentication nature of the attack and the early leak of the CVE identifiers all point to the same conclusion: patch quickly.

Start with internet-facing servers, particularly those using mod_php, and verify the installed version against the official advisory instead of assuming an update has been applied.