OruanyiAlert
Menu

Security news · 21 October 2026

PHP2Shell: PHP fixes CVE-2026-109618 and CVE-2026-109619

What is PHP2Shell and which PHP versions fix it?

On 21 October 2026 the PHP project published advisories for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, which Oruanyi calls PHP2Shell for short. On affected servers, an attacker on the internet could take control of a site without logging in. The fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (dated 22 October 2026 in the PHP changelog), or a hosting-provider build that includes those fixes, followed by a restart of the server’s PHP processes.

Last updated .

The two vulnerabilities

  • CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): remote code execution through out-of-memory corruption. Rated Critical, CVSS v4.0 9.2.
  • CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): remote code execution through stale global state. Rated Critical, CVSS v4.0 9.2.
  • Both affect PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12.

Fixed versions

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35 — security support for the 8.2 branch ends on 31 December 2026, so 8.3 or newer is the safer target.

PHP 8.1 and older

PHP 8.1 and older are end-of-life and receive no official PHP release for these flaws. According to CERT-EU, the PHP security team also published minimal source backports for 7.4, 8.0 and 8.1 for those who build PHP from source; some hosts and Linux distributions ship patched builds. The recommended fix is upgrading to a supported version after checking compatibility on a staging copy.

What site owners should do now

  • Find the exact PHP version. In WordPress: Tools → Site Health → Info → Server. A hosting panel often shows only the branch, such as 8.3.
  • Update PHP to the fixed release for your branch, or ask your hosting provider to confirm their build includes both CVE fixes.
  • Restart the server’s PHP processes (PHP-FPM or the web server) so the new version loads.
  • Confirm the new version is live, then skim recent server logs for unfamiliar PHP files or requests.
  • Updating WordPress core, themes or plugins does not fix PHP2Shell: the flaws are in PHP itself.

Oruanyi’s own systems

Oruanyi.com and the Oruanyi client desks run on Cloudflare Pages and Workers, not PHP, so PHP2Shell does not affect them.

How Oruanyi can help

  • Free passive scan at oruanyi.com/scan: public pages only, after you confirm by email.
  • Authorized security scan: exact PHP version, deprecated software and common security gaps, with a written report and recommended fixes. One-time, non-refundable; priced on oruanyi.com/scan.
  • PHP security remediation: only after a scan finds PHP2Shell or another critical PHP issue, quoted in writing first. Price options are on oruanyi.com/scan.
  • Before any work, the site owner, or senior management authorized to decide, confirms in writing.

Sources

  1. GHSA-w8hw-w9fx-j79w — RCE via OOM corruption (CVE-2026-109618), PHP security advisory
  2. GHSA-6wmf-4rv5-p3rp — RCE via stale global state (CVE-2026-109619), PHP security advisory
  3. PHP 8 ChangeLog, php.net
  4. Supported PHP versions, php.net
  5. CERT-EU Security Advisory 2026-018, Critical Vulnerabilities in PHP
  6. oss-security: CVE-2026-109619, PHP 8.2–8.5 RCE via stale global state

See every public price, read the FAQ, or run the free passive scan.