PHP2Shell: emergency patch for a critical PHP RCE

• Security
• PHP
• WordPress

On 21 October, PHP released emergency patches for two critical unauthenticated remote code execution vulnerabilities, scoring 9.2 on CVSS. They are known as PHP2Shell: CVE-2026-109618 (memory-exhaustion corruption) and CVE-2026-109619 (a use-after-free). Amazon had already detected real exploitation before the disclosure, and Sansec has reproduced the attack against WordPress, Drupal, Joomla, Magento, Laravel, Symfony, phpMyAdmin and Nextcloud.

The detail that matters most if you run a website: this is a flaw in the PHP language itself, not in each application. Updating WordPress or your plugins is not enough. You must update the server’s PHP — to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the fix backported by your distribution or cPanel — and restart php-fpm, Apache or LiteSpeed, because the patch only takes effect once the workers are restarted.

If you are on managed hosting, ask your provider for confirmation. If your website was delivered through Kit Digital by a digitalising agent, write to them and have them confirm the server is patched and restarted.

We have put together a permanent PHP2Shell alert page with the concrete steps, how to check your website’s PHP version (never scanning other people’s sites) and the official sources. If you need help updating it, talk to us.

Update (October 23): PHP has officially acknowledged a third CVE, 2026-115560: another RCE, tied to session.upload_progress when the application switches the session serializer. It is not a bypass of the October 21 patches — a new, narrow vector, with a fix pending for the next regular release. Immediate mitigation: session.upload_progress.enabled = 0 in the server-level php.ini (an application-level ini_set() is not enough) and restart the workers. Full details on the alert page.

Source: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php