These two CVEs are related: they are two critical vulnerabilities in PHP itself, disclosed on October 21, 2026.

What they have in common

  • They allow an attacker to execute code on the server with a crafted HTTP request, without authentication. PHP assigns each of them a score of 9.2 (critical).
  • They have been dubbed “PHP2Shell”.
  • They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any application running an older version is affected, regardless of the framework.

What sets them apart

  • CVE-2026-109618: it relies on PHP’s memory limit. Exceeding memory_limit while processing a request triggers an abrupt exit (a longjmp), leaving the engine in an inconsistent state.
  • CVE-2026-109619: it exploits leftover request state. At the end of a request, PHP frees certain elements (user-defined error handlers and superglobals), but leaves the pointers in place until the next request. A warning raised too early, for example by an invalid .htaccess or .user.ini directive, can then access them. The demonstrated attack uses the session upload progress tracking feature and, on PHP 8.5, fatal error backtraces.

Everything is patched on my end.

I have updated my servers and applications to fix these security vulnerabilities.

Why is everyone alarmed?

PHP powers 80% of the web.

Instructions for carrying out the attack have been published, so even a novice developer could potentially execute it.

These vulnerabilities allow attackers to take control of a PHP web server and gain access to its database, for example, along with all the personal information it contains.

Hackers could also hijack a server to launch attacks against another target.

Small programs can also be installed on servers to carry out malicious actions later.

That is why all sensitive websites have been taken offline: government websites, banking sites, online stores, and so on.

Since the patches were released, simply comparing the old code with the new version is enough to identify the vulnerabilities that were present.

And because many PHP applications are considered “legacy”, meaning they have not been updated in a long time, updating them quickly is difficult.

Some companies are not even aware that they have certain PHP applications and servers online.

So there will be plenty of work for developers and cybersecurity professionals!