PHP2Shell: Critical RCE Vulnerabilities Affecting PHP Core

• •Two critical RCE vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026.
• •Both vulnerabilities allow unauthenticated remote code execution, affecting major platforms like WordPress and Drupal.
• •Exploitation attempts have been observed in the wild, with public PoC code available.

On October 21, 2026, the PHP security team released emergency patches for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These vulnerabilities allow unauthenticated attackers to execute arbitrary code on servers running vulnerable PHP versions, affecting a wide range of applications including WordPress, Drupal, and Joomla. The flaws stem from improper memory handling during request processing, with CVE-2026-109618 related to out-of-memory (OOM) conditions and CVE-2026-109619 involving stale global state. Exploitation attempts were reported shortly after the vulnerabilities were disclosed, with proof-of-concept (PoC) code circulating publicly. PHP installations serving web requests, particularly those using Apache with mod_php, are at the highest risk. Organizations are urged to patch immediately to mitigate potential exploitation.