PHP2Shell (CVE-2026-109618, CVE-2026-109619): What to Do Now

Two critical PHP core bugs, CVE-2026-109618 and CVE-2026-109619, can give attackers remote code execution without logging in. Here's what happened, who's affected, and what to do today.

Wassap mga BitLods.

It's not every day that the NSA and the FBI both tweet about a programming language. Today they did, and the message was basically:

Update PHP now. If you can't, take the site offline until you can.

That's not normal advice. Usually it's "patch soon." This time it's "patch now or unplug." So let's break it down.

What happened

On 21 October 2026, two critical vulnerabilities in PHP core went public:

CVE-2026-109618
CVE-2026-109619

Security folks are calling the pair PHP2Shell. Both are rated 9.2 (CVSS v4.0) and both can lead to unauthenticated remote code execution. In plain words: someone on the internet can potentially run their own code on your server without logging in to anything.

The messy part: details leaked online before the coordinated disclosure, so attackers and defenders found out at the same time. That's why the warning was so loud.

PHP shipped fixes the same day in:

Branch	Fixed version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

PHP 8.1 and older (including 7.x and 5.x) are end of life and get no official fix. If you're still there, it's upgrade time talaga, or check if your Linux distro or hosting vendor backports the patch.

What the bugs are (short version)

Reports describe them a bit differently, but roughly:

CVE-2026-109618: memory corruption after PHP runs out of memory, which can be pushed into code execution.
CVE-2026-109619: state left behind in memory after a request ends. Besides code execution, some researchers say it can leak memory from other requests, which may include passwords, session tokens, API keys or TLS keys.

You don't need to understand the internals. What matters: it's in PHP itself, not in WordPress or Laravel or a plugin. So every PHP install that serves web requests is in scope: Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed.

Who should care

If any of these are you, this is your sign:

You run WordPress, Joomla, Drupal, Magento, Laravel, or any PHP app.
You're on shared hosting (cPanel, Hostinger, etc.). Your host has to patch PHP, but you should still check your PHP version in the control panel.
You have that old client site na hindi na ginagalaw since 2021. Yes, that one.
Your company uses a vendor product that bundles PHP (admin panels, appliances, internal tools).

What to do today

1. Find where PHP runs

Make a quick list. Servers, VPSes, containers, shared hosting accounts, old projects. Internet-facing first.

php -v

On hosting panels, look for "PHP version" or "Select PHP version."

2. Update to a fixed version

Get to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distro's patched package). Then restart PHP-FPM / Apache so the new binary is actually the one running.

# Debian/Ubuntu example, adjust to your setup
sudo apt update && sudo apt upgrade
sudo systemctl restart php8.3-fpm   # or apache2
php -v

If you use Docker, rebuild from an updated base image and redeploy. Pulling the image alone doesn't fix running containers.

3. Can't update right away?

This is where the NSA/FBI advice kicks in: take the site offline until you can patch. Masakit, pero mas masakit ma-hack.

Some researchers suggest setting session.upload_progress.enabled = 0 in php.ini as a stopgap for CVE-2026-109619. Treat that as temporary and incomplete, not a fix.

4. Watch for signs of compromise

The FBI's checklist is a good one:

PHP processes suddenly spawning shells (sh, bash) or downloading files (curl, wget).
New or changed .php files you didn't upload, especially in upload folders.
New admin users you don't recognize.

If something looks off, isolate the server, keep your web server and PHP logs, and (if you're in the US) report to your FBI field office or ic3.gov. Everyone else: tell your hosting provider and your local CERT.

Is it being exploited?

As of 21 October 2026, CISA said it had not observed exploitation yet, and I couldn't find the two CVEs in CISA's Known Exploited Vulnerabilities catalog. There are scattered reports of attacks and several governments took sites offline as a precaution, but those are not confirmed at the time of writing. With details already public, assume it's a matter of time.

The FBI post also points to a "CERT-EU Security Advisory 2026-018". I couldn't find that advisory published yet, so check CERT-EU's advisories page directly.

The BitLods takeaway

Check your PHP version today.
Update and restart.
Can't update? Take it offline.
Old PHP 7/8.0/8.1 sites: this is the push to finally upgrade or retire them.

Mas mabuti nang five minutes of downtime kaysa five weeks of cleanup.

Sources

This is a fast-moving story. Details may change as PHP and security teams publish more. Always follow the official advisories over a blog post, including this one.