Two critical remote code execution flaws in PHP itself, CVSS 9.2. Fixed versions, temporary protections and how to check your servers.
On 21 October 2026 the PHP project released fixes for two critical vulnerabilities in the PHP core, widely called PHP2Shell. They are in the language runtime itself, not in a CMS or plugin, so almost every website and web application written in PHP is affected until it is updated. According to the PHP advisories, a single crafted request can trigger the attack before any application code runs.
| CVE | What it is | Severity |
|---|---|---|
CVE-2026-109618 | Memory corruption during out-of-memory handling (for example while parsing multipart uploads) — remote code execution | Critical, CVSS 4.0: 9.2 |
CVE-2026-109619 | Stale request state reused by the next request on the same worker (use-after-free) — remote code execution | Critical, CVSS 4.0: 9.2 |
CVE-2026-115560 | Third issue announced by CERT-EU on 23 October; details to be published with the next PHP release | Remote code execution |
The PHP team considers mod_php (PHP running inside Apache) the highest-risk setup; PHP-FPM, LSAPI and FrankenPHP are also considered susceptible. CERT-EU reports that proof-of-concept code has started to circulate.
php -v.These steps from the PHP advisories and CERT-EU reduce risk but do not make a server safe:
session.upload_progress.enabled=0 in php.ini or the FPM pool (not via ini_set() or .user.ini) and restart all PHP workers.fatal_error_backtraces=0.post_max_size small (8M if you do not accept uploads) and limit request size and multipart parts on the web server or proxy.RLIMIT_AS / RLIMIT_DATA limits — they can trigger the vulnerable path.PHP is embedded in many products: control panels, NAS devices, monitoring systems, routers' web interfaces and appliances. Ask your vendors whether their products are affected and install their updates.
Update first, then harden. Temporary settings only buy time.
CySec can check your servers for vulnerable PHP versions, apply updates with minimal downtime and set up monitoring for new advisories.
Sources: PHP advisory GHSA-w8hw-w9fx-j79w, PHP advisory GHSA-6wmf-4rv5-p3rp, CERT-EU 2026-018.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.