Critical PHP RCE Vulnerabilities CVE-2026-109618/19: Patch Immediately (CVSS 9.2)

Official PHP Security Advisory: Critical Remote Code Execution Vulnerabilities

On October 21, 2026 at 22:00 UTC, the Chaitin Security Emergency Response Center detected two remote code execution vulnerabilities in PHP Core (CVE-2026-109618 and CVE-2026-109619), referred to as "php2shell" in public discussions. Both vulnerabilities are rated Critical with CVSS v4.0 score 9.2.

PHP officially confirmed both vulnerabilities and released security updates on October 21, 2026 at 22:00 UTC. Chaitin has verified vulnerability triggering in a lab environment. All PHP users are advised to immediately inventory assets, prepare patch windows, and isolate or migrate versions that no longer receive security support.

Affected Versions and Patches

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been released to fix two critical unauthenticated remote code execution vulnerabilities. All PHP users are strongly urged to update immediately.

Who Is at Risk

All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The mod_php deployment is considered highest risk because demonstrations show unauthenticated requests can trigger the attack before any application code executes.

Vulnerability Details

RCE via Memory Exhaustion (OOM) – CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): The OOM handler may interrupt PHP execution before internal request data is fully initialized. The request cleanup routine may then treat invalid data as valid.

RCE via Stale Global State – CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): Request-owned internal state persists after its underlying memory is freed. Subsequent requests handled by the same worker process may use this stale state before normal initialization resets it.

How to Update

Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Source code downloads are available on the PHP downloads page ( https://www.php.net/downloads.php); Windows sources and binaries are on the same page.

Linux distributions and LTS vendors received patches in advance; check with your vendor for updated packages.

PHP 8.1 and earlier no longer receive updates from the PHP project. Some distributions and LTS vendors may provide backported fixes; contact your vendor or upgrade to a supported version.

Due to the severity, the PHP security team has provided minimal source-code backports for PHP 7.4, PHP 8.0, and PHP 8.1 to assist those building from source or without access to an LTS vendor.

Mitigations If You Cannot Update Immediately

While only updating fully resolves the issues, the following measures can reduce risk from specific attack vectors but do not guarantee safety.

For CVE-2026-109618 (OOM RCE)

Set memory_limit=-1 (unlimited) in a way applications cannot override, e.g., using php_admin_value in FPM pool or Apache configuration. Verify no pool, directory, or application setting resets the memory limit. This eliminates controllable PHP memory-limit failures, though underlying allocation failures may still trigger the vulnerability.

Set a low post_max_size. For applications not requiring file uploads, set post_max_size = 8M. If file uploads are needed, set post_max_size = 32M. Keep upload_max_filesize below the post_max_size threshold. Consider enforcing limits at the web server or proxy level: decoded request size, input field count, multipart body part count, request header count, and nesting depth. These limits must also cover requests without a Content-Length header.

Use container or cgroup limits as an availability boundary, preferably with a policy that only terminates the affected worker. Do not use RLIMIT_AS or RLIMIT_DATA because they may cause the vulnerable allocation to fail.

For CVE-2026-109619 (Stale Global State RCE)

Set session.upload_progress.enabled=0 and restart every worker. Apply via php.ini in FPM pool or server configuration before request parsing. Do not rely on ini_set(), FPM .user.ini. This blocks the confirmed session-upload-progress path but not other variants.

In PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This only blocks the confirmed fatal-error-backtrace path.

Remove invalid or deprecated diagnostic settings applied per-request before initialization. Use --hash-extends or --hash-extends to hide diagnostic information; configure error_reporting and disable display_errors; avoid using the @ error-suppression operator.

Fix attacker-triggerable fatal errors and execution timeouts, including failures in callbacks, upload/import handling, and cleanup.

Additional Vendor Response

Baota (宝塔) has also released a fix announcement for its environment.

Final recommendation: If your project is developed in PHP, upgrade according to the official version patches as soon as possible to avoid major losses.