Developing: The PHP project has released emergency security patches for two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, with fixed builds now available for supported versions, according to BleepingComputer.
The PHP security team said the flaws are collectively known as PHP2Shell and affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The published fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with the team urging administrators to update as soon as possible.
According to Help Net Security, the security team said the vulnerabilities could allow unauthenticated attackers to execute code remotely on web servers, and that systems using mod_php face the highest risk because a single request can trigger the issue before application code runs.
The warning follows earlier advisories that urged administrators to prepare for the patch release. In its advance notice, the PHP team said it reserved the right to release fixes earlier if details became public or if there were signs of active exploitation, while the UK National Cyber Security Centre also advised organizations to patch PHP systems immediately or take them offline until they can be updated.
Several security researchers and vendors have since echoed the urgency. Corelight said it released detections for php2shell after coordinated work with OpenAI, PHP and others, while Aikido said the flaws are severe enough that administrators should treat exposed PHP systems as needing immediate attention.
What remains unclear is how widely the vulnerabilities were being exploited before the patches landed, and how many unpatched systems remain exposed. Administrators running PHP are being told to verify their version, install the latest supported release and check with hosting providers or distribution vendors for backported fixes if they are on older branches.