# PHP2Shell: Patch PHP Today in 3 Steps

> Two critical PHP RCE flaws (CVSS 9.2), found with AI's help, were attacked before the patch shipped. Who's at risk, and the 3-step fix.

*2026-10-25T08:11:44Z*

On Wednesday 21 October 2026, the PHP security team shipped emergency releases for every supported branch. The reason: two flaws, together called **PHP2Shell**, each rated **9.2 out of 10**. Two things are new this time: AI helped find them, and attacks started hours before the patch shipped.

If you run any server with PHP on it (Laravel, WordPress, anything), this is for you. The 3-step fix is below.

## What happened?

The two flaws:

- **CVE-2026-109618 (RCE via OOM corruption):** when PHP runs out of memory at the wrong moment, request data can be left half-initialized, and request cleanup may treat it as valid.
- **CVE-2026-109619 (RCE via stale global state):** request-owned internal state can survive after its memory is freed, and a later request on the same worker may use it before it is reset.

In both cases the result is **unauthenticated remote code execution, with no user interaction**.

## Who is at risk?

According to php.net: **every PHP installation serving web requests**. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for **mod_php**, where a demonstrated exploit triggers with one request before any application code runs.

So updating Laravel or WordPress **does not fix it**. The bug is in PHP, not your framework.

## How did AI find it?

PHP's GitHub advisories credit researchers from **Calif**, **Wiz** and **OpenAI**. Per the coverage, Calif found the first bug in August with help from **GPT-5.6 Sol**, in an OpenAI-funded audit of PHP's source, and Wiz found the flaws independently weeks later using Gemini and GPT. Calif says it used generally available models and no special tooling.

Meanwhile the details leaked early, PHP moved the release up, and Cloudflare saw the first attacks at 07:43 UTC. The patch shipped at 14:00.

## The fix in 3 steps

**1. Check your version**

```bash
php -v
```

Safe versions: **8.5.12**, **8.4.27**, **8.3.36** or **8.2.35**. Note that distro packages (Ubuntu, Debian, RHEL) may keep the old version number with the fix backported. Look for the CVE in the changelog:

```bash
# Debian / Ubuntu (adjust the version)
zgrep CVE-2026-109618 /usr/share/doc/php8.3-common/changelog.Debian.gz
# RHEL / AlmaLinux / Rocky
rpm -q --changelog php-common | grep CVE-2026-109618
```

**2. Update PHP**

From your distro or php.net. On **8.1 or older** there are no official PHP releases: get a vendor backport or upgrade to a supported version. Note that 8.2 reaches end of life on 31 December 2026.

**3. Restart every worker**

```bash
sudo systemctl restart php8.4-fpm   # or apache2
```

Without a restart, the old build is still the one in memory.

## Can't update today?

php.net published settings that reduce exposure, such as `session.upload_progress.enabled=0` in php.ini (not via `ini_set`), `fatal_error_backtraces=0` on 8.5, and a low `post_max_size` if you don't need big uploads. **They are painkillers**: php.net itself says they "do not make an installation safe". Updating is the only fix.

## The lesson

AI now finds bugs faster, for defenders and attackers alike. OpenAI calls this the "Defender's Window": the gap between discovery and exploitation is now hours. So:

- Security updates on servers should be automatic, or at least same-day.
- You should know which PHP version every server runs without having to look it up.

If you run a fleet of servers and want help finding every PHP install and patching without downtime, that's part of my [codebase audits](https://fadymondy.com/en/services/codebase-audits).

Patched? Tell me your version in the comments.

---

*Sources: [php.net advisory (21 October 2026)](https://www.php.net/archive/2026.php#2026-10-21-5), [GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w), [GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp), [Sansec](https://sansec.io/research/php2shell), [The Next Web](https://thenextweb.com/news/php2shell-php-rce-ai-openai-wiz). Facts checked on 23 October 2026.*

---

Source: https://fadymondy.com/en/blog/php2shell-patch-php-today