Today, October 21, 2026, the PHP security team published an emergency advisory: two critical vulnerabilities in the language core itself — collectively dubbed PHP2Shell — allow an attacker to execute code remotely and without authentication on any server serving PHP over the web. This is not a WordPress bug, not a plugin bug, not a misconfiguration on your part: it lives in the interpreter.

The maximum severity comes from an important technical detail: the malicious request is processed before a single line of your code runs. It does not matter how well written your application is — login, validation, app-level WAF — because the attack happens inside PHP itself while it prepares the request.

The two new CVE entries

Both share the same root cause — PHP can leave its memory in a corrupted state when a request ends abnormally — but they are exploited through different paths. Each carries a CVSS score of 9.2 (critical):

  • CVE-2026-109618 — Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup then treats that invalid data as valid, leading to memory corruption and remote code execution with the web worker's privileges.
  • CVE-2026-109619 — Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it: heap use-after-free, memory disclosure and, again, unauthenticated remote code execution.

They affect every PHP installation serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates the risk highest for mod_php, where a demonstrated exploit fires before any application code runs.

Affected pages

We audited our entire infrastructure and these are the pages serving PHP versions below the patched releases — vulnerable until the update is applied:

  • PHP 8.3.35 (vulnerable, requires 8.3.36): www.io-backup.com, www.dynamicdnspro.com, www.fisem.com.
  • PHP 8.4.25 (vulnerable, requires 8.4.27): www.emhaseasociados.es, app.emhaseasociados.es.
  • PHP 8.4.26 (vulnerable, requires 8.4.27): scanner.net-analyzer.com, app.fisem.com, buy.dynamicdnspro.com.

If you run your own sites, check the version each one exposes with curl -sI https://yourdomain.com | grep -i x-powered-by. Note: a missing header does not mean you are safe — it only means the server does not advertise it.

Urgent measures

The only complete fix is to upgrade PHP. The patched versions are:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

For PHP 8.1 and older — out of support — the PHP team shipped minimal backports for 7.4, 8.0 and 8.1, but the official recommendation is to migrate to a supported branch. Meanwhile, these are the measures we are applying and recommend:

  1. Update to the patched release of your branch as soon as possible, prioritizing Internet-facing servers.
  2. Immediate partial mitigation: set session.upload_progress.enabled=0 in php.ini and, on PHP 8.5, also fatal_error_backtraces=0. Restart every worker after the change. Note: analyses by Datadog and JFrog stress this mitigation is partial, not complete — it does not replace the patch.
  3. Set memory_limit=-1 instead of RLIMIT-based limits to reduce OOM corruption paths.
  4. Filter at the edge: a WAF or reverse proxy in front of PHP can block anomalous multipart requests before they reach the vulnerable parser.
  5. Monitor: check logs for unusually large form submissions, memory-exhaustion errors during request initialization, and unexpected shell processes spawned by PHP workers.

If you cannot patch immediately, CISA even recommends taking exposed PHP systems offline until they can be updated. A drastic recommendation for a drastic vulnerability.

Conclusion

PHP2Shell is the kind of flaw that only appears once every few years: critical, unauthenticated, and sitting in the layer below every application. The patch already exists and applying it takes minutes on most systems. We are already updating every affected page listed above; if you run anything on PHP, now is the time to do the same.