Key points
- CVE-2026-109618 and CVE-2026-109619 are rated 9.2 severity and enable remote code execution.
- Millions of attack attempts have been recorded against systems running the affected PHP versions.
- The PHP Foundation released patches early after an embargo was broken by a distributor.
Attackers gained the ability to launch remote code execution attacks by exploiting two critical vulnerabilities in PHP. The flaws, collectively known as PHP2Shell, could allow attackers to execute code remotely. The source material states that CVE-2026-109618 and CVE-2026-109619 could allow attackers to launch remote code execution (RCE) attacks. This capability poses a significant risk to enterprises using the widely-used programming language.
In plain English
The weaknesses involve critical flaws in the PHP programming language. One of these flaws, CVE-2026-109618, is linked to an out-of-memory problem. The PHP Foundation acknowledged that a contractor discovered signs of this out-of-memory problem as far back as 2024. However, no concrete vectors were found initially, and other issues with clear impact overshadowed concerns about this specific flaw.
View the original post on X
The background
Deep research into the problem occurred on 30 July 2026, after the PHP project joined OpenAI’s Patch the Planet program. Researchers from Calif, OpenAI, and Google Cloud’s Wiz made the full impact of the out-of-memory problem clear. The PHP Foundation set a coordinated disclosure embargo for 22 October at 14:00 UTC. Distributors, including Chainguard, received patches in advance to update users immediately upon disclosure.
What changes now
Chainguard unilaterally broke the embargo on 20 October around 15:00 UTC, causing CVE IDs to circulate online. The PHP project brought its pre-announcement forward, publishing it at 19:30 UTC. This allowed attackers to study the fix in binary form and craft proofs-of-concept before defenders could update. AWS and Cloudflare contend that active exploits began hours or days before the disclosure.
The attacker's path
Teams usually assess exposure by identifying all assets running the affected software versions. Check whether your inventory includes PHP installations that lack the latest security updates. This stage of an intrusion serves as the initial foothold, allowing attackers to establish remote control. Focus on verifying that no unpatched endpoints remain accessible from the internet, as this is the primary vector for exploitation in such scenarios.
What to do and how to stay safe: PHP
- Inventory all servers and applications running PHP to identify those affected by the recent vulnerabilities.
- Apply the latest security patches provided by the PHP Foundation as soon as they are available.
- Monitor web server logs for unusual traffic patterns or signs of remote code execution attempts.
- Consider temporarily restricting access to vulnerable services until updates are confirmed across all systems.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the CVE IDs for the PHP2Shell vulnerabilities?
The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619.
How severe are these vulnerabilities rated?
They are rated at a 9.2 severity level, which is considered critical.
Why were patches released earlier than planned?
The PHP Foundation released patches early after Chainguard broke the coordinated disclosure embargo.
