PHP2Shell (CVE-2026-109618 and CVE-2026-109619): What to Know

On October 20, news broke that there would be an “upcoming critical PHP security release” to address two vulnerabilities with a CVSS score of 9.2. Because a major portion of the web operates on PHP, this was a crucial announcement that captured global attention.

What These Vulnerabilities Do

CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities that can enable remote code execution (RCE). This means that an attacker can freely run commands from a remote location on a target system. These vulnerabilities are being referred to as PHP2Shell.

Each vulnerability introduces a unique RCE risk, according to PHP.net:

• RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

• RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

Who Is Impacted

Anyone who is not running one of these versions of PHP is at risk:

• 8.5.12

• 8.4.27

• 8.3.36

• 8.2.35

Actions Oneleet Has Taken

As soon as the news broke, our team pulled a list of customers who have PHP exposed using our platform’s Attack Surface Management feature. We also pulled customers who have PHP frameworks listed in their Dependency Scanning.

From there, our Security Program Managers (SPMs) reached out to impacted customers to inform them of what’s going on, including step-by-step actions to take to mitigate risks. If you’re a customer who’s at risk and have ASM or DepScan configured, you have already been notified. If you are not a customer yet, you can check out our ASM and Dependency Scanning tooling by booking a demo.

Some of our customers were surprised to find that they had PHP in their environment as shadow IT. If you aren’t a Oneleet customer, please be sure to investigate your environment to ensure you’re not at risk, because as our customers told us, PHP instances may be lurking in your environment without your knowing.

What You Should Do

We give everyone the same advice we gave to our customers: update PHP to one of the following versions:

• 8.5.12

• 8.4.27

• 8.3.36

• 8.2.35

Older versions of PHP are end-of-life, but patches may be available from LTS distributors. If not, one quick action you can take is to isolate end-of-life PHP from the internet.