PHP issued emergency patches on October 21, 2026, for two remote code execution vulnerabilities now being actively exploited. CVE-2026-109618 and CVE-2026-109619 affect PHP versions 5 through 8, which covers most of the self-hosted PHP infrastructure on the internet. The PHP team rates both at CVSS 9.2 under version 4.0; the researchers who reproduced the flaws rate them at 10.0. The difference is academic. Either number means the same thing: an unauthenticated attacker can run arbitrary code on your web server.
What is PHP2Shell
The PHP project disclosed the vulnerabilities ahead of the patch release, giving researchers and defenders a narrow window to prepare. watchTowr confirmed they reproduced CVE-2026-109618 and chose not to publish technical details until patches were available. That is the responsible approach. What it tells you is that the bar for exploitation is low enough that an experienced researcher could get there independently within the disclosure window.
The flaw is in PHP's core. PHP versions 5, 6, 7, and 8 are all believed to be affected. A deleted post on Hacker News claimed the vulnerabilities trace back to PHP 5 code, which has been in the codebase for over two decades.
Active exploitation started the same day patches arrived
Cloudflare's CTO confirmed on October 21 that Cloudflare is observing early attack attempts and has deployed WAF rules. That is meaningful. Cloudflare usually has near-real-time visibility into internet-wide attack patterns; when their CTO is talking about it publicly the same day patches drop, the exploitation wave is already underway.
The PHP core team was explicit: no workaround exists. Suggested mitigations circulating online, such as disabling session.upload_progress or blocking multipart/form-data requests, are unverified. A PHP core developer stated these do not reliably prevent exploitation. The only fix is the official patch.
What you need to do
Apply the October 21 emergency patches immediately. Do not wait for a scheduled maintenance window if you can avoid it. The patches were released at 14:00 UTC on October 21 and are available for all supported PHP versions.
If you cannot patch right now, your WAF may reduce the attack surface temporarily. Cloudflare's rules are already deployed for Cloudflare customers. Other WAF vendors should follow shortly. Treat this as hours of breathing room, not a resolution.
Check your PHP version across all services, containers, and build environments. The affected range is wide: PHP 5 through 8 is a long tail that includes a lot of legacy infrastructure that people forget about.
After patching, review your web server logs for any requests matching exploitation patterns from the past 72 hours. If Cloudflare was seeing attacks on October 21, there may have been probe traffic earlier.
The bigger picture
PHP powers a significant portion of the internet's web applications, including a large share of WordPress, Drupal, and custom CMS installs. A critical RCE with no workaround affecting versions 5 through 8 is the kind of vulnerability that gets weaponized in ransomware campaigns, data theft operations, and cryptomining deployments. The combination of wide attack surface, active exploitation, and no fallback mitigation makes this a genuine P0 for any organization running PHP.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to talk through your PHP infrastructure exposure.