PHP2Shell: CVE-2026-109618 and CVE-2026-109619

Two memory flaws in PHP that can lead to remote code execution, actively exploited since October 2026.

Published in the NVD on 21/10/2026

CVE-2026-109618

CVSS 3.1: 9.8 (critical) actively exploited

In the CISA catalogue of actively exploited vulnerabilities since 26/10/2026

Exploitation probability (EPSS, 01/11/2026): 99.999 %, percentile 99.998

CVE-2026-109619

CVSS 3.1: 8.1 (high) actively exploited

In the CISA catalogue of actively exploited vulnerabilities since 26/10/2026

Exploitation probability (EPSS, 01/11/2026): 99.999 %, percentile 99.999

What is PHP2Shell?

PHP2Shell is the name for two related flaws in PHP. In CVE-2026-109618 some contexts leave request memory uninitialised after an out-of-memory error, and the request cleanup then reads or branches on it. In CVE-2026-109619 global state can still point into request memory after it has been freed, and later requests read it. According to the NVD both can lead to remote code execution.

The NVD rates CVE-2026-109618 at CVSS 9.8 and CVE-2026-109619 at 8.1, and CISA has listed both as actively exploited since 26 October 2026. According to the NVD, CVE-2026-109618 also affects PHP 7.3 to 8.1 and CVE-2026-109619 even PHP 5.4 to 8.1, but these branches no longer get fixes because their support has ended.

Affected and fixed versions

PHP 8.5

Affected: 8.5.0 - 8.5.11

Fixed in 8.5.12

PHP 8.4

Affected: 8.4.0 - 8.4.26

Fixed in 8.4.27

PHP 8.3

Affected: 8.3.0 - 8.3.35

Fixed in 8.3.36

PHP 8.2

Affected: 8.2.0 - 8.2.34

Fixed in 8.2.35

PHP 7.3 - 8.1

Affected: 7.3.0 - 8.1.x (CVE-2026-109618, CVE-2026-109619)

No fixed version given in the NVD data

PHP 5.4 - 7.2

Affected: 5.4.0 - 7.2.x (CVE-2026-109619)

No fixed version given in the NVD data

All branches and vulnerabilities of PHP

Status in Debian and Ubuntu

Debian 12: php8.2

Fixed

Fixed from package version 8.2.35-1~deb12u1

Debian 13: php8.4

Fixed

Fixed from package version 8.4.27-1~deb13u1

Ubuntu 22.04 LTS: php8.1

Fixed

Fixed from package version 8.1.2-1ubuntu2.28

Ubuntu 24.04 LTS: php8.3

Fixed

Fixed from package version 8.3.6-0ubuntu0.24.04.13

Ubuntu 26.04 LTS: php8.5

Fixed

Fixed from package version 8.5.4-0ubuntu1.5

What to do

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install the fixed package of your distribution. If you still run PHP 8.1 or older, move to a supported branch.

Erseni Patch tells you when a new vulnerability affects exactly your version, and when your release branch loses its support. Add the program or package with your version and we check it right away.

Watch PHP

Watch php8.2 (Debian 12)

Watch php8.4 (Debian 13)

Watch php8.3 (Ubuntu 24.04 LTS)

Already have an account? Log in and add PHP