PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

PHP's maintainers have shipped fixes for two critical flaws dubbed PHP2Shell—CVE-2026-109618, an out-of-memory corruption bug, and CVE-2026-109619, a stale global state issue—both scoring 9.2 on CVSS and allowing unauthenticated remote code execution, confirmed against Apache running mod_php. The updates landed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal backports for 7.4, 8.0 and 8.1, after the PHP Foundation moved the release forward a day because exploit details leaked early. Security firms including WatchTowr, Hadrian, Patchstack, Cloudflare and Vega report in-the-wild exploitation attempts against PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed installs, with some already using public proof-of-concept code, though no confirmed successful compromises have been verified yet by WatchTowr. Because the flaws sit in PHP's core rather than any CMS, they potentially threaten sites built on WordPress, Drupal and MediaWiki, affecting an estimated 70% of websites worldwide and risking leaked credentials and secrets from process memory.