PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline

PHP released emergency patches on October 21, 2026, for two critical memory-safety RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, both rated 9.2 on CVSS v4.0. The flaws affect all PHP installations serving web requests including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed, with exploitation possible before any application code executes. NSA and CERT-EU urged organizations unable to patch immediately to take affected systems offline or isolate them from public networks. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with minimal backports also published for PHP 7.4, 8.0, and 8.1. Cloudflare reported active attack traffic with attackers already attempting to evade WAF protections. Approximately 48.5% of PHP websites run end-of-life branches, making the patch rollout particularly challenging. Wiz researchers noted that AI models helped accelerate the development of working exploits across applications in hours. Remote memory disclosure is also possible, potentially exposing passwords, tokens, and API keys without first achieving code execution.