On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — the October 2026 security release — fixing two critical vulnerabilities in the language runtime itself: CVE-2026-109618 and CVE-2026-109619, each scored 9.2. The discoverers gave the pair a shared name: php2shell. Disclosure had been scheduled for October 22 and was moved up a day because the details leaked. CISA's alert is blunt: the bugs "allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests." The earliest exploitable path Calif documents dates to PHP 5.4.0 — a 2012 interpreter, still in service somewhere near you, running a bug-class first demonstrated against PHP in 2004.

What the bug actually is

Stripped to its mechanism: PHP can end up with dangling state when an allocation would exceed memory_limit, or when a fatal error interrupts native code before its normal cleanup completes. Request shutdown then frees memory that surviving state still references. That is a use-after-free window reachable from application input, because the trigger is a request — a crafted upload, or absurdly nested arrays in a form — that pushes a request-specific fatal. Calif stitched together two general ways to produce the OOM-fatal and three different interruptible points in the interpreter, which combine into reliable chains against mod_php and PHP-FPM; LiteSpeed's LSAPI is affected, PHP's web server under Windows is affected, and FrankenPHP's status is reported as unclear. The second CVE plays the same family in two moves: the first request corrupts the error-management state, the second exploits it.

The exploitation is not a one-shot spray. Both chains need thousands to tens of thousands of requests before one lands — exactly the shape automated attack infrastructure handles well, and Calif's own demo video runs 38 seconds from cold start to system commands executed on a Laravel host. Heartbleed was also a loop until it worked.

The list that reads like your stack

Calif confirmed pre-authentication RCE against, at these versions:

  • WordPress 7.1.2
  • Nextcloud 35.0.1
  • Roundcube 1.7.4
  • phpMyAdmin 5.2.3
  • MediaWiki 1.46.2
  • Drupal 11.4.3
  • Joomla 6.1.4
  • Magento 2.4.9
  • Laravel 13.11
  • Symfony 8.1
  • WHMCS

That is not a hypothetical software set; that is what a club, a fire hall, a small municipality, a clinic and a housing co-op run on the servers they take responsibility for. If a community ever asked you to "put up a website" and you reached for a PHP application, this bug class came with the deal — see what this site wrote about the gap between running open source and maintaining it. The language core had not produced a critical of this shape since 2017 (CVE-2017-5340); application-level bugs like the WordPress core RCE patched in late September lived and died inside a week. This one is different in kind: it removes the assumption that a well-maintained application on a current framework version is safe, no matter how current it is.

Governments took their websites offline — on purpose, at scale

The response is the part this site wants on the record, because nothing like it has run at this scale before. Germany's BSI advised organizations to take PHP-based web presences offline until patches were available, and CISA said the same: organizations that cannot immediately update — or that still run PHP 8.1 or earlier, which is outside security support — "should take PHP-based systems offline until they can be patched or updated."

They did it. Reuters lists government sites in Denmark, Finland, France and the Netherlands pulled or put into maintenance mode; heise's follow-up reports Berlin's Charité hospital taking all pages down, parts of berlin.de offline, the Freie Universität Berlin restricting services, Berlin's police online presence unreachable, and state administrations in Bavaria and Lower Saxony doing the same; NDR reported the first of them back online by the next morning. Availability was knowingly traded away, at national scale, because the alternative was an unpatched unauthenticated RCE on infrastructure people depend on. Your community site will never appear on a Reuters list, but the decision it faces on a day like this is the same decision with smaller numbers and no press release. The part of the government playbook worth stealing: the decision was made ahead of a confirmed exploit, with incomplete information, because waiting for one costs more.

The inventory homework is the unglamorous part

CISA's first bullet is the one to sit with: "PHP is often a component of other software and prevalence may not be directly observable." Inventorying the web server is an afternoon. The part that bites on this bug:

  • Appliance web consoles. Management surfaces of network and storage boxes are commonly PHP and commonly reachable: pfSense, OPNsense and the small-router crowd (DrayTek, ZyXEL, D-Link, TP-Link, Netgear, Tenda), NAS boxes (QNAP, Synology), and the security-appliance tier (Citrix, Palo Alto, Ivanti, F5 BIG-IP). Most of these do not let you upgrade their bundled PHP yourself — the fix arrives on the vendor's schedule, which is precisely the dependency nobody audits. Treat exposed management interfaces as attack surface, not defense: behind a VPN or a firewall allowlist, same reflex as with the Proxmox root-bypass advisory this site covered in September.
  • Containers. Any image that brings its own PHP — application images, old all-in-one stacks, the container somebody built before the org invented change management — is its own PHP install. docker compose pull && docker compose up -d on everything you own, and a scan of what you no longer remember you own.
  • Transitive installs on small boxes. Single-board servers doing quiet jobs in community networks often picked up PHP as a dependency of something else, and nobody remembers. If you cannot name what PHP is for on a box, patch it or unplug it.
  • Shared hosting. If a community site is on a hoster, this is the week to find out how they handled it. Some were visibly prepared — Uberspace publicly scheduled a window where it would disable PHP services outright — and if yours says nothing, that is the finding.

Versions, and what to do about old ones

Patched: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Backports cover 7.4, 8.0 and 8.1, which are outside normal support but got one more kindness. The EOL math has not changed; this bug sharpens it. PHP 8.2's support ends at the close of 2026, so a migration to 8.3 or later — supported through the end of 2027 — pays twice. Until packages land, the mitigation set PHP published is explicitly temporary: memory_limit=-1 for mod_php and PHP-FPM, which removes the cap that arms the bug and buys a memory-exhaustion DoS in its place; session.upload_progress.enabled=0 for FPM; post_max_size kept small relative to the memory limit; low pm.max_requests; SELinux/AppArmor confinement; fatal_error_backtraces=0. Cloudflare shipped WAF rules covering the known attack vectors, including on the free tier, and its own CTO called them a temporary fix. Debian's packages landed that evening, with Fedora's, Gentoo's, Ubuntu's and Red Hat's; Slackware and SUSE followed overnight. The distribution coordination machinery worked on a compressed schedule — the boring part of open source, doing its job.

The disclosure timeline, without the mythology

The history is part of the lesson, and the details are on the record. The memory-limit bug class is not new: Stefan Esser found the first one in 2004; PHP bug #78876 reported the OOM shape in 2020; the OSTIF/Quarkslab audit of PHP in 2024 rediscovered a related bug but could not prove exploitation, so it was left unfixed. In July 2026, OpenAI's Patch the Planet brought Calif together with the PHP Foundation's Ecosystem Security Team — created in May with paid security engineers, which a language still powering most of the server side of the web should be allowed to have. First bug reported August 11; PHP confirmed the PoC August 15; second bug August 21; one release on October 21, moved a day early by a leak.

Two surveillance facts complete the picture. Amazon observed exploitation attempts four days before the planned disclosure — with the honest caveat, in Amazon's own writeup, that the early traffic may have been probing a different file-upload bug, and that the source of pre-release information is unclear. Cloudflare counted millions of exploit attempts starting roughly ten hours before details went public. No successful compromise is confirmed as of this writing, and that is the report this site will print the correction for if it turns out to be wrong. The window between "patch exists" and "someone is scanning you" is no longer a window; it is a countdown with negative values.

On the AI-shaped part, the skeptical post this site published on the ESR claim does not need updating, because this is not that claim. The researcher documented how the bugs were found: not with generic prompts, but by standing on twenty years of PHP memory-limit history and holding a theory that specific bugs remained in the codebase. LLMs assisted variant analysis and patch verification. On their own, the researcher writes, they drift from the newest and most prominent bugs and do not reliably reach for a twenty-year-old exploitation primitive. No model unearths all bugs. A person who knows a target's history, armed with the analysis tools of the moment, still moves the drill. That is an encouraging update in exactly one way: the foundation's security team got funded, a 2024 loose end got finished, and a coordinated disclosure survived a leak three days out.

The order this week

  1. Inventory first — CISA is right about this: package lists (dpkg -l 'php*', rpm -qa | grep php) on every box, container images, appliance web consoles, single-board servers, and wherever a hoster runs a site for you.
  2. Patch internet-facing systems first, to the fixed releases above.
  3. Cannot patch today? Take it offline or wall it off — the advice of both government agencies, and its first appearance at this scale.
  4. On unsupported PHP (8.1 and earlier): CISA's guidance is explicit — offline until patched or updated.
  5. After patching, monitor for PHP worker processes spawning shells or downloading tools; the exploit's endgame is visible in process accounting, which beats trying to distinguish thousands of harmless-looking requests.

The precedent set this week deserves the name this site would defend: a vulnerability with a Heartbleed shape, an unauthenticated entry point and no known exploitation produced a response in which national governments decided that a temporarily closed service harms fewer people than an open one. The patch is named. The window is the one before tens of thousands of hostile requests find the host that stayed up.