PHP2Shell: Critical PHP vulnerabilities patched, update now!

The PHP project has rushed out fixes for a pair of critical flaws, dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, that allow an attacker to run arbitrary code on a web server with a single unauthenticated request. CVE-2026-109618 stems from memory corruption triggered by out-of-memory handling during request cleanup, while CVE-2026-109619 arises from stale internal state left over from a previous request being reused before proper reinitialization. Virtually any PHP deployment that handles web traffic is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php setups considered most exposed; working exploit code already exists and security researchers warn this could trigger a wave of incidents. Users should upgrade immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, check with their Linux distribution or LTS vendor for backported packages on older branches, and note that Cloudflare has already rolled out WAF rules covering known exploitation paths for all customers.