A global cybersecurity crisis is currently underway, following the emergency disclosure of two critical, unauthenticated remote code execution (RCE) vulnerabilities in PHP, collectively dubbed “PHP2Shell.”.
Tracked as CVE-2026-109618 and CVE-2026-109619, these flaws affect an estimated 70% of the internet, prompting governments, infrastructure providers, and enterprises worldwide to scramble to patch their systems or take websites offline entirely.
PHP Foundation’s PHP Project yesterday released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, to fix the two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP.
Any organisations running PHP are urged to update now.
The two related critical remote code execution vulnerabilities are:
- CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (out-of-memory): If a request reached PHP’s memory_limit at exactly the wrong moment, PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.
- CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: RCE via stale global state: A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request handled by the same worker could then use that freed memory. A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.
Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions.
Sergey Lozhkin, head of research centre for APAC and META at Kaspersky GReAT, explains that the critical vulnerability has been identified in PHP, a widely used server-side programming language that powers websites, web applications, content management systems such as WordPress, and many backend services across the Internet.
“Given PHP’s role in supporting millions of web servers worldwide, this may prove to be one of the most significant vulnerabilities of 2026,” he says.
The issue has been assigned a severity rating of 9.2, underscoring its critical nature.
“The potential impact is considerable: If successfully exploited, this vulnerability could enable remote code execution, one of the most serious forms of cyber compromise.
“In practical terms, attackers could potentially execute malicious code on affected systems, including the deployment of web shells, thereby gaining control over vulnerable servers.
“Incidents of this kind can escalate rapidly across the global cyber landscape, particularly when they involve technologies that are so widely deployed. For that reason, the response must be immediate and decisive.
“If your infrastructure depends on PHP, the patch should be applied as soon as possible, as prompt remediation will be essential to minimising exposure and protecting critical systems.”
For more information, visit this Securelist link: https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/