PHP2Shell Can Run Before Your Application Does

On October 21, 2026, the PHP project shipped emergency releases for two critical bugs, tracked together as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution on PHP that serves web requests. The advance notice on October 20 rated both CVSS v4.0 9.2 and set the release for 14:00 UTC on October 21.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP says the only complete fix is that update. A login form, a WordPress plugin, and a WAF rule all sit in the wrong place if the request is handled before application code runs.

Snapshot

At risk: every install that serves web requests — PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP considers the risk highest for mod_php, and says a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. WordPress admin login, plugin MFA, and upload settings inside the app do not get a turn.

The two bugs, in PHP’s words:

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) is remote code execution via out-of-memory corruption. Out-of-memory handling can interrupt PHP while internal request data is only partly initialized. Cleanup may then treat that invalid data as valid.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) is remote code execution via stale global state. Request-owned internal state can survive after its backing memory has been freed. A later request on the same worker may use that stale state before normal initialization resets it.

What to install

Linux distributions and LTS vendors received the patches in advance, so the package may already be in the vendor repo. PHP 8.1 and older no longer get updates from the PHP project. Some distributions and LTS vendors backport fixes. The PHP security team also published minimal source backports for 7.4, 8.0, and 8.1 for people building from source or without an LTS vendor.

If the server uses the volunteer repo rpms.remirepo.net, PHP says that repo will not have the packages on release day. Switch to distribution packages or build from source so the update can go on today.

PHP 8.2 reaches end of life on December 31, 2026 and gets no further security fixes after that date. 8.2.35 is the patch for this pair of bugs. Plan the move off 8.2.

The advisory lists partial steps and says they do not make an installation safe. The release announcements are shorter: there are no complete mitigations. One listed step removes PHP’s own memory limit. That step is incomplete — an underlying allocation failure can still reach the bug — and it is the wrong thing to paste into a pool as a substitute for the patch. We are not repeating those settings. CERT-FR CERTFR-2026-ALE-014 (October 21) tells operators of PHP 5, 6, 7, 8.0, and 8.1 to isolate those hosts and move to a maintained, patched release. CERT-FR marks its own workaround list as unqualified, and that list covers only part of the issue.

Cloudflare’s blog (October 21) says WAF rules for these bugs went on by default at 03:02 UTC for customers with the WAF, including the Free plan, and that Cloudflare saw attack traffic. The same post says customers should still patch. BleepingComputer (Sergiu Gatlan, October 21) reports that Cloudflare CTO Dane Knecht called those protections temporary, and that the UK NCSC told organizations to update PHP or take the systems offline until they can.

MFA on the accounts around this incident

Cloudflare’s 2FA page (updated April 20, 2026) offers three factors on the same screen: Mobile App Authentication (TOTP; Google Authenticator and Microsoft Authenticator are named), Security Key Authentication (WebAuthn; YubiKey is named, and built-in authenticators such as Touch ID and Windows Hello count as passkeys), and Email Authentication. Email codes are the weaker choice. Enroll a key and an authenticator app. Dashboard 2FA does not patch PHP on an origin server, and neither does the WAF rule.

WordPress.com already grades Strong: authenticator apps, SMS, passkeys, and physical FIDO2 keys including YubiKey. SMS is the weaker factor — enroll a key. That login protects WordPress.com. It does not stop a request that runs before application code on a self-hosted PHP origin. wordpress.org in the audit table is the project site, not that hosted login.

Directory: MFA support directory · Infrastructure and Email & Identity.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited the PHP project, the WAF vendor, the WordPress project site, Apache, the UK NCSC, and BleepingComputer on October 21, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not measure whether a host is running a patched PHP binary.

Audit links: cloudflare.com · ncsc.gov.uk · wordpress.org · apache.org · bleepingcomputer.com · php.net

php.net is 42% overall and Identity 25%. A mail that says “install this PHP tarball” should be checked against php.net typed by hand. wordpress.org, apache.org, and bleepingcomputer.com sit at 15% transport.

Website stack

Passive homepage + Certificate Transparency probes (October 21, 2026). Versions only — not a claim these sites were compromised, and not a claim the homepage certificate says which PHP binary a customer origin is running.

Blacklist and lookalikes

Email blacklist checks (public DoH, October 21, 2026): php.net, cloudflare.com, wordpress.org, apache.org, ncsc.gov.uk, and bleepingcomputer.com were clear on mail/domain lists we can query. wordpress.org showed Barracuda on a web IP — shared-edge noise, not led.

Registered lookalikes that matter if a “patch PHP now” mail points at a fake download or a fake status page:

php.com and php.org also have mail. php is a short label, so that scan is not evidence those domains are impersonating the PHP project. wordpress.com is Automattic’s hosted product, not a squat of wordpress.org. The ncsc.gov.uk scan mostly returned short gov labels. Those are dictionary collisions, not NCSC typos. Type php.net yourself. Continuous monitoring: Cybersquat Domain Monitoring.

CourtListener searches on October 21, 2026 for PHP2Shell, CVE-2026-109618, and CVE-2026-109619 returned no dockets.

Related coverage

• PingCAP / TiDB Cloud incident
• eMudhra intermediate CA keys
• MFA support directory

Sources: PHP security advisory, Oct 21, 2026 · CERT-FR CERTFR-2026-ALE-014 · Cloudflare WAF post, Oct 21, 2026 · BleepingComputer, Oct 21, 2026 · Cloudflare 2FA · WordPress.com security keys. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 21, 2026. Domain scores: audit.emailmenow.com only.