Two newly disclosed vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, put a widely deployed web runtime under scrutiny. In the worst case, an unauthenticated attacker could execute code in the affected PHP process. Exploitation is technically demanding and depends on the deployment, but the potential impact makes PHP2Shell PHP security updates a priority for teams that operate web applications.
These are flaws in PHP’s handling of exceptional conditions, not necessarily a defect in an application’s own code. According to the PHP project’s security advisory, out-of-memory handling can leave request data incompletely initialized, while fatal-error handling can leave stale state that a later request reaches. Demonstrated outcomes across the reported techniques include worker crashes and data exposure as well as possible remote code execution. Code execution would occur with the permissions of the affected PHP process; it does not automatically mean root access.
What site owners should do now
Inventory the PHP versions actually serving each site, including separate application pools and hosting environments. The PHP version checker provided for this issue may help with an initial check, but a remote result should not replace confirmation from your host or server inventory. The checker was not independently accessible during our review. Then install the applicable security update from your PHP distribution or hosting provider as soon as possible. The PHP project identifies 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases for its supported branches; distributions may backport the fix without changing to those exact version numbers. For older branches, check your vendor’s advisory or plan an upgrade to a supported release.
While the update is being rolled out, watch for unusual PHP memory-exhaustion or fatal errors, repeated worker crashes and suspicious request patterns. Investigate anomalies in context rather than treating a crash as proof of exploitation. Temporary configuration changes may reduce specific attack paths, but the PHP project says they do not fully remove the risk and are not substitutes for patching. Coordinate deployment and restart requirements with the team that operates the PHP runtime.
The immediate leadership question is whether every internet-facing PHP deployment has an identified owner, an accurate runtime inventory and a clear patch path. Prioritize the exposed services, verify the fix after deployment, and keep monitoring for signs that warrant incident investigation.
Further reading: PHP security advisory and technical analysis of the reported exploitation paths.