PHP2Shell: Find and Patch Every PHP Server You Run (2026)

On October 21, 2026, the PHP project released emergency updates to fix PHP2Shell, involving critical vulnerabilities CVE-2026-109618 and CVE-2026-109619. These flaws allow unauthenticated remote code execution and remote reads of worker memory regardless of application code. Users must inventory PHP runtimes, apply patches, and restart processes to ensure security. The PHP project confirms that updating is the only safe choice, as no complete mitigations exist for these critical engine bugs affecting various deployments.