PHP ships fixes for two critical flaws

The four releases

The PHP project published four security releases on 21 October 2026. They fix two memory-safety defects in the PHP runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell.

This is not a CMS, framework or plugin update. Both advisories describe flaws below the application layer. A fully patched WordPress, Drupal or Laravel installation still runs on an exposed PHP binary if the runtime has not been updated.

The affected surface is every PHP installation serving web requests. PHP names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, and singles out mod_php because the demonstrated attack can run before application code executes. PHP 8.1 and older have no upstream fix; the project published minimal source backports for 7.4, 8.0 and 8.1, while distributions and LTS vendors may ship their own backports.

What the patch does not cover

Patch status and evidence status are separate. A fixed release exists, which is a strong, verifiable fact. It does not mean any particular host has installed it, restarted its workers or rebuilt its container images. Those are separate checks, and the verification guide walks through them.

The two flaws are also not interchangeable. CVE-2026-109618 is an out-of-memory handling defect; CVE-2026-109619 is a stale-global-state use-after-free. They were disclosed together, but they have different trigger conditions and different interim controls. This site keeps them as separate vulnerability records rather than collapsing them into one severity label.

There is no complete configuration workaround. PHP’s own advisory says updating is the only complete mitigation. The interim settings are worth applying when an update cannot happen immediately, but they buy time rather than closing the issue. A WAF can also buy time; Cloudflare deployed rules roughly nine hours before disclosure and explicitly told customers to patch anyway.

What to check first

Confirm the runtime, not just the command-line binary. A server can report one version through php -v and serve requests through a different FPM pool, container image or application bundle. Then confirm that every worker was restarted after the update. The remediation guide covers the official interim controls and their limits.