PHP2Shell: patch two critical code-execution flaws

By AgentDASTPublished Nov 3, 2026Sources checked Nov 3, 2026

First reported Oct 21, 2026

CVE-2026-109618CVE-2026-109619

The PHP project released fixes for two critical memory-management and error-handling flaws on October 21. The PHP Foundation reports unauthenticated remote code execution under affected conditions, including demonstrated attacks involving Apache with mod_php and an application-level path through PHP-FPM.

Who should check

Servers running vulnerable PHP builds. Assess the actual web-serving runtime, extensions and deployment image; checking only a developer's command-line PHP version can miss the runtime serving production traffic.

What to do now

Apply the appropriate fixed release: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later supported release containing the fixes. Check your distributor's advisory when using backported packages.
Rebuild and redeploy affected images, then verify the PHP version used by the running web workers.
Review the vendor's deployment-specific guidance and monitor for signs of compromise. A successful patch does not undo an earlier intrusion.

What this means for your website

These are runtime defects, so an application login is not a substitute for patching. After updating, verify that the intended deployment is running and retest your application's exposed behavior. A clean assessment is not proof that every CVE is absent.

Sources and updates

This brief reflects the sources checked on Nov 3, 2026. Follow the linked vendor notices for subsequent corrections and updates.

Find your own weak spots.

Test your live website and give your coding agent evidence it can act on.

Set up your agent →