SecOraLens
CriticalCVECVE-2026-109618

PHP ships emergency patches for critical PHP2Shell flaws

BleepingComputer·Source published ·1 min read

What happened?

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]

Key details

  • PHP2Shell flaws affect all PHP installations serving web requests via multiple SAPIs
  • Both vulnerabilities stem from PHP leaving memory in a corrupted state when a request ends abnormally
  • CVE-2026-109618 enables RCE via out-of-memory corruption triggering chain of weaknesses
  • CVE-2026-109619 enables heap use-after-free, memory disclosure and RCE with web worker privileges
  • PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 are the fixed versions for PHP 8.x series
  • PHP 8.1 and older no longer receive updates from the PHP project

Affected

  • All PHP installations serving web requests via multiple SAPIs

Fixes and mitigations

  1. Install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 for PHP 8.x

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories