PHP fixes php2shell remote code execution flaws: update to 8.5.12 or 8.4.27

The PHP project published a security advisory on October 21, 2026 titled “Critical remote code execution vulnerabilities, update now.” It released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two flaws, CVE-2026-109618 and CVE-2026-109619, which researchers have named php2shell. “All PHP users are strongly encouraged to update immediately,” the advisory says. Cloudflare, which added firewall rules for the flaws, writes that they affect “all web servers running PHP 5.4 or later.”

What changed

PHP describes the two bugs this way:

CVE	PHP’s title	What goes wrong
CVE-2026-109618	RCE via OOM corruption	Out-of-memory handling can stop PHP while request data is only partly set up, and cleanup then treats it as valid
CVE-2026-109619	RCE via stale global state	Internal state can outlive its freed memory, and a later request on the same worker may use it

Cloudflare says possible impacts include denial of service, remote code execution and data exposure. It says the flaws were disclosed by Calif.io, Wiz, OpenAI and Quarkslab. On October 23 PHP added an informational advisory for a related issue, CVE-2026-115560, in the session upload progress feature. It will be fixed in the next regular release, and until then PHP advises setting session.upload_progress.enabled=0.

Who it affects

Anyone running a PHP site, including WordPress, WooCommerce and most shared hosting. The fix is in the PHP runtime itself. Cloudflare notes that updating site code or plugins does not fix it. PHP 8.1 and older “no longer receive updates from the PHP project,” so sites on those versions need a vendor patch or an upgrade to a supported branch.

What to do

• Managed or shared hosting: ask your host whether PHP has been updated to one of the fixed versions. Linux distributions and LTS vendors got patches in advance, the advisory says.
• Your own server or VPS: install your vendor’s updated packages or the fixed release, then restart every PHP worker.
• If you can’t update yet: PHP lists stopgaps such as session.upload_progress.enabled=0, memory_limit=-1 and a low post_max_size, but says they “do not make an installation safe.” Its release notes put it plainly: “updating is the only safe choice.”
• Cloudflare users: Free plans are covered by the Cloudflare Managed Free Ruleset with no action needed. Pro, Business and Enterprise customers should check that the Cloudflare Managed Ruleset is in block mode. Cloudflare says the rules are an added layer, not a replacement for patching.

If your host is slow to patch, our web hosting comparison and VPS hosting comparison list the alternatives.