TL;DR

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released emergency updates on Oct. 21 for two critical vulnerabilities that can enable unauthenticated remote code execution in web-facing PHP deployments. The Dutch government said several sites, including DigiD, were taken offline as a precaution; it did not report confirmed compromises.

PHP released emergency updates on Oct. 21 for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated attackers to execute code on vulnerable web-facing deployments. The Dutch government said it took several public websites offline, including Overheid.nl, MijnOverheid.nl and DigiD, as a precaution; its announcement did not say those services had been compromised.

PHP’s security advisories assign both vulnerabilities a CVSS v4.0 score of 9.2. One flaw involves request data left partly initialized after an out-of-memory failure, which can lead to memory corruption. The other involves internal state retaining references to memory that has already been freed, allowing a later request in the same worker to encounter stale data. PHP says these conditions can lead to remote code execution.

The PHP security team lists web request deployments using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as potentially affected. Exposure depends on the deployment and configuration. The advisories describe demonstrated exploitation on Apache with mod_php; code execution as a web worker does not by itself mean an attacker has administrator or root access.

Fixes were released for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Operators using older versions or vendor-managed packages need to confirm with their provider that both fixes are included. Updating a site’s application, themes or plugins alone does not patch the PHP engine.

Public Services Face Patch Pressure

The flaws affect the runtime that processes web requests, so a vulnerable server may be exposed even when its website software has been updated. Operators need to identify the PHP version actually serving web traffic, apply the appropriate fixed package and confirm that the change is active after any required restart or redeployment.

The Dutch shutdowns show that organizations may choose to limit service availability while they assess or reduce risk. Officials characterized the closures as precautionary, not as evidence of an intrusion. Cloudflare separately reported attack attempts against its customers, but that statement does not establish that the named Dutch services were targeted or affected.

Installing an update also cannot establish whether an earlier intrusion occurred. PHP operators may need to review relevant logs and investigate unusual activity alongside patching. The advisories describe possible execution with the web worker’s privileges; the consequences therefore depend in part on the account and permissions under which each deployment runs.

How the PHP Flaws Differ

Both vulnerabilities concern PHP’s handling of memory and internal state during request processing, but they arise through different failure conditions. In CVE-2026-109618, an out-of-memory event can interrupt an operation before request data is fully initialized. Cleanup may then handle invalid data as if it were valid. In CVE-2026-109619, internal state may outlast the memory it references, creating a use-after-free condition that a subsequent request can encounter.

PHP’s advisories and technical research cited in the source material describe deployment-specific paths to exploitation. Some demonstrated mod_php attacks can occur before application code runs. PHP-FPM handles certain startup failures differently, but that does not establish that every PHP-FPM deployment is safe; the research describes application-dependent paths as well. Operators should use the official advisory and their software vendor’s guidance to assess their setup.

The source material also says researchers at Calif, OpenAI and Wiz used AI-assisted research tools in work that helped identify the flaws. PHP maintainers handled the fixes and releases. That account describes a role for AI in research, while the technical validation, patching and deployment remained work involving researchers and maintainers.

“Both vulnerabilities carry a CVSS v4.0 score of 9.2, Critical.”

— PHP security team

Exposure Depends on Each Deployment

The available source material does not establish how many servers were vulnerable, how many were successfully exploited, or whether any of the named Dutch websites experienced unauthorized access. The government described its shutdowns as precautionary, and the Cloudflare report does not resolve whether attacks succeeded against other organizations.

It is also unclear how quickly hosting providers and organizations will deploy fixes across production, staging and legacy systems. Older version numbers may not show whether a vendor has applied a backport. A critical score alone cannot determine whether a particular deployment is exploitable, and the impact of code execution depends on the affected process’s privileges.

Operators Verify Patched Runtimes

Website operators should check every web-facing PHP deployment, including older and staging systems, and confirm whether the web runtime has a fixed release or a vendor package that addresses both CVEs. Command-line PHP may use a different installation from the runtime handling site traffic. After updating, operators should complete any required restart or redeployment and verify that requests reach the patched runtime.

Organizations that cannot patch immediately should consult their hosting or security provider about restricting access or temporarily taking affected services offline. PHP’s official advisories remain the reference for release and configuration guidance. After patching, operators should review relevant logs for suspicious activity because a software update does not undo any earlier intrusion.

Key Questions

What are the PHP2Shell vulnerabilities?

They are two PHP flaws, CVE-2026-109618 and CVE-2026-109619, involving memory handling and internal state. PHP says they can enable unauthenticated remote code execution in affected deployments.

Which PHP versions include the fixes?

The releases listed in the advisories are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1; users of vendor packages should confirm the fixes with their provider.

Were DigiD and the other Dutch sites hacked?

The Dutch government said the sites were taken offline as a precaution. The source material does not report confirmed compromises of Overheid.nl, MijnOverheid.nl or DigiD.

Does updating WordPress fix these flaws?

No. These vulnerabilities affect the PHP runtime. Updating WordPress, its themes or its plugins does not patch the PHP engine; the server runtime or its vendor-provided package must be updated.

Does a successful attack mean an attacker gets root access?

Not automatically. PHP describes code execution as the web worker account; the resulting access depends on that process’s privileges and the affected system’s configuration.

Source: Thorsten Meyer AI