CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)
CVE-2026-109618 and CVE-2026-109619 are the two CVE IDs behind PHP2Shell. Both are rated CVSS 9.2 and both are fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
| CVE | Vulnerability | Impact | Demonstrated |
|---|---|---|---|
| CVE-2026-109618 GHSA-w8hw-w9fx-j79w | Out-of-memory (OOM) corruption | Code execution without authentication as the PHP web worker | Pre-auth RCE on WordPress, Drupal and Joomla |
| CVE-2026-109619 GHSA-6wmf-4rv5-p3rp | Stale global state across requests (use-after-free) | Worker memory disclosure or code execution | Pre-auth RCE on WordPress and Drupal; app-agnostic memory disclosure |
CVE-2026-109618: RCE via out-of-memory corruption
If a request hits PHP's memory_limit at exactly the wrong moment, PHP can leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. RCE was also confirmed on PHP-FPM through application-level code paths.
CVE-2026-109619: RCE via stale state
A fatal error at the wrong point can leave internal state pointing to memory from a previous request. A later request handled by the same worker can then use that freed memory. A use-after-free and worker crash were confirmed, and remote code execution was shown against a real-world application on Apache with mod_php. This is also the path to application-agnostic memory disclosure: passwords, tokens, API keys and certificates from other requests.
Affected versions for both CVEs
| PHP branch | Vulnerable | First fixed release |
|---|---|---|
| 8.5 | < 8.5.12 | 8.5.12 |
| 8.4 | < 8.4.27 | 8.4.27 |
| 8.3 | < 8.3.36 | 8.3.36 |
| 8.2 | < 8.2.35 | 8.2.35 |
| 8.1, 8.0, 7.4 and older | All releases | No new official release. Use a vendor package with the fix backported, or move to a fixed branch. |
Affected releases go back to PHP 5.4. Almost every version before the fix is affected by at least one of the two issues.
Timeline
- 2024: the first signs of the OOM problem surfaced during an external PHP security audit. No concrete exploit path was known then.
- 2026: Wiz Research, OpenAI Codex Security and Calif reported working exploit chains, built with help from AI models.
- October 21, 2026: PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Details had leaked shortly before, and exploit attempts were reported.
How the two PHP2Shell CVEs relate
Both CVEs come from the same weakness: PHP did not always leave its internal state consistent when a request failed at a bad moment. CVE-2026-109618 is about running out of memory mid-operation. CVE-2026-109619 is about a fatal error leaving pointers to memory that the next request reuses. The researchers combined these paths into the exploit script they named php2shell, which is where the family name comes from.
In practice you do not patch them separately. The same PHP releases fix both, and the PHP team says the fixes address the underlying failure patterns rather than only the demonstrated exploit paths. If you are on 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or a vendor build whose changelog lists both CVE IDs, you are covered for both.
CVE-2026-109618 vs CVE-2026-109619 at a glance
- Trigger: 109618 needs a request to reach
memory_limitat the wrong moment. 109619 needs a fatal error at the wrong point, followed by another request on the same worker. - Most exposed setup: Apache with mod_php for both. 109618 can fire before any application code runs.
- Worst outcome: remote code execution for both. 109619 can also leak memory from other users' requests without running any code, which is harder to detect.
- Temporary measures: the memory settings on the mitigation page mainly target 109618. Lowering
pm.max_requestsand turning off fatal-error backtraces mainly target 109619.
CVE-2026-109618 and CVE-2026-109619 FAQ
What is the CVSS score of CVE-2026-109618?
Both CVE-2026-109618 and CVE-2026-109619 are rated CVSS 9.2 (critical) in the official disclosure.
Do I need separate patches for CVE-2026-109618 and CVE-2026-109619?
No. PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix both. Vendor packages should list both CVE IDs in their changelog.
Which PHP versions are affected by CVE-2026-109619?
Affected releases go back to PHP 5.4, and nearly every version before the fix is affected by at least one of the two issues. Exposure depends on version, configuration and the specific vulnerability, so treat every unpatched runtime as affected.
Is CVE-2026-109618 being exploited?
Details leaked before the planned disclosure, and security firms reported exploit attempts on October 21, 2026. Patch now rather than waiting for confirmed breaches.
Sources
Check your own server with the PHP2Shell checker.