PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team has rushed out emergency updates for two critical, unauthenticated remote code execution bugs collectively dubbed PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both stem from PHP corrupting its own memory state when a request terminates abnormally, and they affect every setup that handles web traffic, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, with mod_php considered the riskiest since attackers can trigger the exploit before any application code even runs. Researchers from Calif, Wiz, and OpenAI found the flaws, and Cloudflare has already spotted early exploitation attempts even before the patches landed, prompting the UK's NCSC to urge organizations to patch immediately or take affected systems offline. Admins running PHP 8.x should move to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 right away, while unsupported PHP 7.4, 8.0, and 8.1 users have received limited source backports, since temporary mitigations only reduce risk and cannot fully stop attacks on the millions of exposed PHP hosts worldwide.