PHP2Shell: two critical PHP flaws allow unauthenticated RCE

On October 21, 2026, the PHP project released emergency fixes for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. The PHP2Shell flaws enable unauthenticated remote code execution or disclosure of process memory; patches shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

• CVE-2026-109618 involves out-of-memory handling, CVE-2026-109619 is a cross-request use-after-free
• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older are end-of-life
• Wiz demonstrated pre-auth RCE on WordPress, Drupal and Joomla; the bug is in the PHP engine itself
• mod_php is especially high-risk as the exploit runs before application code executes