PHP Rushes Emergency Patch for Critical RCE Flaws
In short: on October 21, 2026, the PHP development team rushed out emergency releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619 (CVSS rated up to 9.2–10.0). Both allow unauthenticated remote code execution on sites served over PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed — in practice, almost any host running WordPress, Joomla, Drupal, Magento or Laravel. Details leaked ahead of the planned coordinated disclosure, forcing some site operators to temporarily take sites offline to apply fixes by hand. If you just browse other people's sites, there's no direct threat to you — the real risk is that a hacked site exposes the database holding visitors' personal data, and our guide on checking for a personal-data leak explains how to check whether yours already has.
What happened
At 17:00 Moscow time on October 21, 2026, the PHP Group shipped a round of fixes — 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — for two critical flaws informally dubbed "PHP2Shell." According to Habr and Xakep, the patch shipped ahead of the originally planned coordinated-disclosure date: exploit details leaked online, forcing developers to accelerate the release before the usual coordination process with hosting providers and major CMS maintainers was fully complete. Some site administrators worldwide temporarily took their sites offline to manually apply the fixes before a working exploit went public.
What the flaws are and why they matter
CVE-2026-109618 is a remote code execution bug triggered when a PHP process runs out of memory — the resulting cleanup failure can be exploited by an attacker. Its official CVSS v4.0 score is 9.2, while independent researchers at WatchTowr rated its real-world exploitability at the maximum, 10.0. CVE-2026-109619 is a use-after-free flaw caused by improper cleanup of the interpreter's global state. Neither flaw requires authentication or any special site privileges — a single specially crafted HTTP request to a vulnerable server is enough.
Which sites are at risk
The issue affects PHP versions 5 through 8 across all major deployment modes — PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. In practice that covers the vast majority of sites on the internet: researchers demonstrated a working "PHP2Shell" exploit against WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS — essentially every major CMS and framework at once. Patches were only released for the currently supported 8.2–8.5 branches; PHP 8.1 and older have reached end of life and won't receive an official fix — on those, the risk stays open until the site migrates to a supported PHP version.
What this means for an ordinary user
There's no direct threat to your own device here — PHP runs on servers, not in your browser. But as a visitor to a store, forum, or any site on a vulnerable CMS, the risk is real and indirect: a hacked site is an open door to the database holding every user's email, passwords, payment details and order history, including yours. The same pattern played out in the FirstVDS hosting breach via a VMmanager flaw — where the person affected isn't the one who made a mistake, but someone relying on infrastructure they never knew was vulnerable.
What to do
If you administer a PHP site — update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (whichever matches your branch) immediately, without waiting for a scheduled maintenance window: with exploit details already leaked, a working attack could surface at any moment. If your site still runs PHP 8.1 or older, there's no patch coming — migrating to a supported version becomes urgent, not optional.
If you log into a server or hosting control panel remotely — especially from a café, hotel, or other public Wi-Fi to rush the patch through — use a VPN: it won't fix the PHP flaw itself, but it encrypts your connection to the admin panel, reducing the risk of your login being intercepted along the way. LiMP VPN does this on Android, Windows, and Chrome under a no-logs policy — see pricing.
If you're just a user of a site on a vulnerable CMS — watch for an incident notice from that service, and as after any major breach, check whether your own data has surfaced in a public dump using the tools in our guide on checking for a personal-data leak.
Sources
Frequently asked questions
Do I need to do anything about this as an ordinary user?
Not directly — the PHP flaw affects servers, not your own device. Indirectly, it's worth checking whether your data has leaked through a site you use often that may have been vulnerable, using the tools in our guide on checking for a personal-data leak: /en/blog/check-if-your-data-was-leaked.
Will a VPN protect my site from this PHP vulnerability?
No, a VPN doesn't fix the vulnerability in PHP's code — the only real protection for a site is updating to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. A VPN helps with something separate: it encrypts your own connection when you log into a server's control panel remotely over public Wi-Fi.
What happens to sites on PHP 8.1 and older that won't get a patch?
Those versions have reached end of life, so no fix was issued for them, and the vulnerability stays open indefinitely. The practical fix is migrating the site to a supported PHP branch (8.2 or newer) rather than waiting for a separate patch that won't come.