On October 21, 2026, PHP released fixes for two critical vulnerabilities that let an unauthenticated attacker run arbitrary code on a server. CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell, carry a CVSS v4.0 score of 9.2. watchTowr confirmed exploitation in the wild the same day through its Attacker Eye honeypot network.
PHP powers a large share of the web, from WordPress and Drupal sites to internal enterprise tools. Both bugs live in the core runtime, not in any single application, so every PHP installation that serves web requests is in scope. That includes PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, and FrankenPHP.
The stakes are straightforward. A server running unpatched PHP can be taken over without a valid account, and the attacker gets to run their own code. CISA added CVE-2026-109618 to its Known Exploited Vulnerabilities catalog on October 26, 2026, which means U.S. federal agencies now have a deadline to patch.
What the two bugs actually are
CVE-2026-109618 triggers when PHP runs out of memory partway through setting up a request. Internal data ends up half-built, and the cleanup code treats that invalid data as valid. CVE-2026-109619 is a stale-state problem: internal state survives after its backing memory has been freed, so the next request handled by the same worker can act on leftover data before normal initialization resets it.
Researchers at Calif discovered both flaws and reported them to PHP for a coordinated disclosure. The planned disclosure date was October 22, but details leaked on social media on October 20. PHP's security team announced an emergency release for October 21 at 14:00 UTC, and watchTowr became the first to confirm publicly that the vulnerabilities were real. PHP published its advisory and fixed releases the next day.
The affected versions span PHP 5.4 through 8.5.11. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older branches going back to PHP 5 are also affected, including versions that have been out of support for years.
Who is exposed
Every PHP installation that serves web requests is affected, regardless of SAPI. PHP considers the risk highest for Apache mod_php, where an attack can succeed before any of the application's own code has run. watchTowr confirmed that unsupported branches, including PHP 5, are also affected, so discovery should cover every PHP installation, not only supported versions.
The PHP project is not backporting fixes to PHP 8.1 or earlier, which have reached end of life. For PHP 7.4, 8.0, and 8.1, the options are a distribution or LTS vendor package, PHP's minimal source backports, or an upgrade to a supported branch. PHP 7.3 and older, including PHP 5, have no fix at all; the recommendation is to upgrade to a supported branch.
Google Cloud, which is not itself vulnerable, published guidance for customers running PHP on its platforms. App Engine standard environment runtimes for PHP 8.2 and newer are patched automatically. App Engine flexible environment applications are not updated automatically and must be redeployed. Cloud Run services with automatic base image updates enabled pick up the fix on their own; others need a rebuild and redeploy.
How to patch and what to do first
PHP states that no configuration change fully mitigates these vulnerabilities. The fix is to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, matching the branch in use. The practical sequence is simple: inventory every server and application that runs PHP starting with internet-facing systems, update each installation to the fixed release, restart every PHP worker so the fix takes effect, and restrict internet access to any PHP system that cannot be updated immediately.
Restarting matters more than it sounds. Upgrading packages on disk leaves vulnerable libphp.so or php-fpm binaries resident in running worker processes. Administrators need to explicitly restart php8.x-fpm, apache2 or httpd, frankenphp, or lsws. Linux distributions were given the patches ahead of release, so updated packages should be available from the distribution's security repository.
Google Cloud recommends capturing memory forensics before restarting suspect hosts. If a server shows signs of active probing or anomalous PHPSESSID cookies, worker memory should be captured first, because restarting workers permanently destroys volatile heap evidence.
Detection and hunting
The watchTowr FAQ and Google's Mandiant guidance list concrete indicators. Typical PHPSESSID cookies run between 22 and 256 bytes, so cookies longer than 256 bytes warrant attention. Bursts of 50 to 150 concurrent persistent OPTIONS * HTTP/1.1 keep-alive connections or slow-chunked multipart POSTs can indicate worker-pool fencing. Repeated .php/ URI segments returning HTTP 404 may indicate a cookie-less heap leak. Rapid interleaved HTTP 500 and 200 POST bursts against the same endpoint can indicate blind pointer-comparison memory disclosure.
On the host side, child processes such as sh, bash, curl, wget, nc, or python spawned by php-fpm, httpd, apache2, or frankenphp under the www-data account indicate RCE payloads. Spikes in FastCGI or PHP-FPM worker respawns with SIGSEGV exit code 139 point to failed heap shaping attempts.
Google's Security Command Center can detect exposed PHP workloads across Compute Engine, GKE, and Cloud Run with the EXTERNALLY_EXPOSED_RCE_VULNERABILITY scanning module. Google Security Operations added 23 new curated detections to the Mandiant Frontline Threats rule pack.
Compensating controls while patching
Cloud Armor managed rules can serve as a frontline defense while patching is underway. The rules target the File Upload and RFI categories and are applied automatically for customers with active managed rules. Large request bodies deserve attention too, since attackers may use large payloads to trigger out-of-memory conditions. These rules are compensating controls only; upgrading PHP and redeploying services is required to fully resolve the vulnerabilities.
Operating system sandboxing helps as well. Running PHP workers with a dedicated unprivileged account, read-only access across document roots, NoNewPrivileges, and cgroup memory limits such as MemoryMax=2G rather than ulimit -v reduces the blast radius. Blocking outbound internet access from PHP servers stops attackers from downloading payloads or creating remote shells.
The bigger picture
The disclosure timeline itself is a caution. Details leaked two days before the planned release, forcing an emergency patch. It is not clear that every organization will patch fast enough, given that unsupported PHP branches remain common in production. PHP is not a niche runtime; it sits underneath a large share of the public web, and a bug in its core request handling is a bug in a lot of infrastructure at once.
The realistic next step for most teams is boring: inventory, patch, restart, then hunt. Anyone still running PHP 7.3 or older has no patch path at all and should treat this as a migration trigger, not a maintenance task.
See the watchTowr FAQ at watchTowr for the full technical breakdown, and Google's guidance at Google Cloud. For related coverage, visit our cybersecurity section.