Two Critical PHP Remote Code Execution Flaws Patched, Attacks Already Observed

On October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which Amazon Threat Intelligence has named PHP2Shell. Both carry a CVSS v4.0 score of 9.2 and can be reached without authentication. The flaws are memory-safety bugs in PHP itself, one caused by memory exhaustion handling and the other by stale global state in persistent workers, so they affect any web-serving PHP setup such as PH-FPM, Apache mod_php and FrankenPHP. Older branches receive no upstream updates, though PHP published backports for 7.4, 8.0 and 8.1, and some distributions ship their own fixes with different version numbers. Amazon reported exploitation attempts on its honeypot network four days before disclosure and broader attempts afterward, and it remains unclear whether those attempts would succeed against real systems.