Two critical PHP bugs fixed on 21 October 2026, CVE-2026-109618 and CVE-2026-109619 (together called PHP2Shell), can be chained for unauthenticated code execution on a web server. AlmaLinux scores both 9.2 on CVSS v4.0, and an exploitation attempt was recorded on 17 October, before public disclosure. If you run PHP anywhere, this is a runtime upgrade, not an application update.

What is affected

  • Any PHP serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed
  • mod_php is the most exposed setup; remote code execution was also confirmed on PHP-FPM for CVE-2026-109619
  • CVE-2026-109618: memory corruption when a request hits the per-request memory limit (a crafted multipart upload can trigger it)
  • CVE-2026-109619: stale state surviving between requests on the same worker, leading to a use-after-free
  • Updating WordPress, Drupal, Laravel or plugin code does nothing here

A practical patch flow

  • Build an inventory: prod sites, staging boxes, admin panels, old microsites and vendor appliances that bundle PHP
  • Record the exact PHP version on each host or image, and get it in writing from managed hosting providers
  • Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distro's patched package (source backports exist for 7.4, 8.0 and 8.1)
  • Restart PHP-FPM or the web server so workers load the new binary, then confirm the running version

If you cannot patch today

  • Disable session upload progress
  • Lower upload and memory size limits
  • Remove per-directory settings that throw warnings
  • Put updated WAF rules in front of the app
  • For public systems that stay unpatched, follow FBI and UK NCSC advice and consider taking them offline

What to look for in logs

  • PHP worker processes spawning command shells
  • PHP processes downloading files
  • Preserve logs before cleanup if anything looks off. In India, check whether the CERT-In six-hour incident reporting rule applies to you.

More detail: PHP2Shell patch guide for Indian website owners

Written by the team at Affix Center, an IT services company in Lower Parel, Mumbai.