Two critical RCEs in PHP core

Cisco Talos has flagged two critical, unauthenticated remote-code-execution bugs sitting deep in PHP core, nicknamed "php2shell," which can be triggered by a simple HTTP request before any application logic even runs. The flaws, CVE-2026-109618 and CVE-2026-109619, both carry a CVSS v4.0 score of 9.2 and touch essentially every PHP release since version 5.4. CVE-2026-109618 stems from out-of-memory handling interrupting request processing while internal data is still half-initialized, letting cleanup treat garbage as legitimate; CVE-2026-109619 involves reuse of stale internal state after its memory has already been freed. Because the flaw lives in PHP itself rather than in a single application, the blast radius covers widely used platforms such as WordPress, Drupal, Magento, Shopware, WooCommerce, Laravel, and cPanel/Plesk-hosted PHP sites. Talos says it has not observed exploitation in the wild as of October 21, 2026, but warns that PHP 8.1 and earlier are already end-of-life with no patch coming, PHP 8.2 support ends December 31, 2026, and roughly half of internet-facing PHP systems may never get fixed, so immediate upgrade to PHP 8.2 or later is strongly urged. Cisco customers get protection via SNORT signatures 67359 and 67360, also released through the Community Ruleset.