October 23, 2026. If your website or online store runs on PHP, it needs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the releases the PHP project shipped on October 21, 2026 to fix PHP2Shell: two critical flaws, CVE-2026-109618 and CVE-2026-109619, that let an attacker run code on the server without logging in. Each is rated 9.2 out of 10 under CVSS v4. Researchers at Calif found one of them with OpenAI's GPT-5.6 Sol, Wiz independently reported both, and Cloudflare said it was already seeing early attacks before the patches came out, BleepingComputer reported.
Key numbers
| Item | Number |
|---|---|
| Fixed release, PHP 8.5 branch | 8.5.12 |
| Fixed release, PHP 8.4 branch | 8.4.27 |
| Fixed release, PHP 8.3 branch | 8.3.36 |
| Fixed release, PHP 8.2 branch | 8.2.35 |
| Fixes released | 21 October 2026 |
| CVSS v4 score, each flaw (CVE-2026-109618 and CVE-2026-109619) | 9.2 out of 10 |
| Branches with minimal source backports (no regular updates from the PHP project) | 7.4, 8.0 and 8.1 |
| Stopgap post_max_size (32M if the site accepts uploads) | 8M |
| OpenAI subsidized Daybreak access for defenders | $1 billion |
Versions, scores and stopgaps read on 23 October 2026 from php.net and the two GitHub security advisories; the Daybreak figure from OpenAI's post of 21 October 2026.
What the PHP project announced
- Two flaws. CVE-2026-109618 lets out-of-memory handling leave request data half-initialized, which request cleanup can then treat as valid; CVE-2026-109619 lets internal state survive after its memory is freed, so a later request on the same worker can use it, per the PHP security advisory and the two GitHub advisories (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp).
- Who is exposed. Every PHP installation that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates mod_php highest, with a demonstrated exploit that fires before any application code runs.
- Fixed versions. Anything below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 is affected. Linux distributions and long-term support vendors received the patches in advance.
- Older PHP. PHP 8.1 and older get no updates from the PHP project. Its security team published minimal source backports for 7.4, 8.0 and 8.1, and some vendors ship their own fixes.
- The AI part. OpenAI says Calif identified a critical flaw using GPT-5.6 Sol under its Patch the Planet initiative, calls the pair one of the most impactful security issues in recent memory, and expects similar findings to "increase sharply in the coming months". It has committed $1 billion in subsidized Daybreak access for organizations with limited security resources that protect essential services, and published a PHP version checker as a Codex skill.
What it means for operators
PHP runs WordPress, and with it WooCommerce stores, as well as Joomla and Drupal sites. The UK's National Cyber Security Centre has told organizations to update or take PHP systems offline until they are patched, according to BleepingComputer. What to do this week:
- Find your version. In WordPress, the server details sit under Tools > Site Health > Info > Server, per the WordPress documentation. A version number alone can mislead: a distribution build can carry the fix under an older number, so ask your host whether its PHP build includes the October 21 fixes.
- Update, or get it updated. On managed or shared hosting, patching PHP is your host's job, so ask for a written confirmation. On your own server or VPS, install the fixed release or your vendor's patched package.
- Only if you cannot update today, apply the PHP team's stopgaps, such as setting session.upload_progress.enabled to 0 and restarting every worker, and a low post_max_size of 8M, or 32M if you accept uploads. The PHP team says they reduce exposure but do not make an installation safe.
- Watch for signs of a breach. Google shows a "This site may be hacked" message in search results when it believes a hacker changed pages or added spam pages, which costs a site its search and AI visibility until it is cleaned. If that visibility feeds your pipeline, see our AI search optimization service.
If an old PHP branch means your site needs an upgrade rather than a patch, see our web development and e-commerce services.
Frequently Asked Questions
PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed on October 21, 2026. Both allow unauthenticated remote code execution on PHP installations that serve web requests, and each scores 9.2 out of 10 under CVSS v4.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no updates from the PHP project, though its security team published minimal source backports for 7.4, 8.0 and 8.1, and Linux distributions and long-term support vendors ship their own patched packages.
If its server runs PHP below the fixed versions and serves web requests, assume yes until your host confirms otherwise. Check the server details under Tools > Site Health > Info > Server, then ask your host whether its PHP build includes the October 21 fixes, since distribution builds can carry them under an older version number.
Only partly. The PHP team lists stopgaps such as setting session.upload_progress.enabled to 0 and restarting every worker, and setting a low post_max_size, but says they reduce exposure to specific attack paths without making an installation safe. Updating is the only complete fix.