PHP2Shell: two unauthenticated RCEs in PHP (CVE-2026-109618 and 109619), and a third flaw with no patch
> TL;DR: On October 21, 2026, the PHP project shipped emergency releases for two critical flaws nicknamed PHP2Shell. CVE-2026-109618 corrupts memory during out-of-memory (OOM) handling, and CVE-2026-109619 reuses freed state between requests. Both allow unauthenticated remote code execution with the web worker's privileges (CVSS v4: 9.2). Fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On October 23, a third flaw, CVE-2026-115560, was published with no fix.
Who is affected
Any PHP installation serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. According to Rapid7, the vendor considers mod_php the most exposed, because exploitation can succeed before any application code runs.
PHP 8.1 and older no longer receive routine updates. For this incident, PHP supplied limited source backports for 7.4, 8.0 and 8.1. If you run one of these branches, use your distribution's fix or upgrade.
How the two flaws work
Where exploitation stands
Several public proofs of concept exist. Rapid7 reviewed them: each works only on a specific combination of operating system, PHP version and web server, and none is broadly reliable. Exploitation attempts are reported. This difficulty is a window to patch, not a reason to wait.
What to do now
ini_set()):session.upload_progress.enabled=0 in php.ini or the FPM pool;fatal_error_backtraces=0;What this means for an AI agent
Many agents call tools hosted on PHP backends: a WordPress plugin, a Laravel API, an in-house CRM. If that backend falls, the attacker controls what the tool returns to the agent, and therefore what the agent reads and does next. Patching the backend is part of the agent's security.
The takeaway
These flaws have existed in PHP since 2004. A mature technology is not an audited one. Inventory where PHP runs in your stack, including the tools nobody considers critical.
Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
PHP and Laravel Ignition: why CVE-2021-3129 left such a mark
CVE-2021-3129 showed how an exposed Laravel debug component could open the door to remote code execution. Here is why this flaw still matters for the PHP ecosystem.
Adobe ColdFusion CVE-2026-48282: a max-severity RCE exploited within 2 hours of disclosure
A maximum-severity flaw (CVSS 9.8) in Adobe ColdFusion 2025.9, 2023.20 and earlier allows unauthenticated remote code execution. Exploitation started within 2 hours of Adobe's disclosure. ~800 instances exposed online. Fix available.
Citrix NetScaler: two pre-auth RCEs, 50,277 exposed instances, CISA deadline Sept 30
CISA lists CVE-2026-88771 and CVE-2026-88772 in the Known Exploited Vulnerabilities: pre-authentication code execution on NetScaler ADC and Gateway, CVSS 9.5. watchTowr has a PoC, GreyNoise observed the first exploitations on September 24, and over 50,000 instances remain exposed.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.