PHP2Shell: CVE-2026-109618 and CVE-2026-109619 — Critical PHP RCE at CVSS 9.2

PHP2Shell: CVE-2026-109618 and CVE-2026-109619 — Two RCE Paths at CVSS 9.2

The PHP2Shell CVE-2026-109618 vulnerability and its companion CVE-2026-109619 represent the most serious PHP security event of October 2026. On October 20–21, details of these critical remote code execution vulnerabilities leaked before patches fully deployed. Both carry a CVSS v4.0 9.2 / 10 rating.

The two paths — PHP2Shell CVE-2026-109618 and CVE-2026-109619

CVE-2026-109618 corrupts memory during out-of-memory (OOM) handling. When PHP's longjmp() fires on an OOM error, request memory is left uninitialized — allowing attackers to trigger reliable RCE with out-of-memory payloads.

CVE-2026-109619 is a use-after-free: state retained between requests is reused after the original object frees. Combined with the OOM corruption, attackers can corrupt memory and then execute arbitrary code in a single chain.

Both are unauthenticated and reachable through standard multipart/form-data uploads. Attack attempts have already been observed in the wild (Cloudflare, watchTowr). Related AIPress coverage: AI Safety Stack and Anthropic Claude Code Security Fixes.

What is affected

Every PHP version before the emergency releases of October 21, 2026. PHP 8.2+ is actively supported; older branches have no fix. Plesk-shipped builds, CMS stacks (WordPress, Drupal), and custom apps are exposed.

Immediate actions

• Patch to the PHP security release immediately.
• Restrict file-upload endpoints if patching is delayed.
• Monitor WAF logs for unusual OOM-trigger payloads.
• Confirm your host's PHP version — Plesk advisory confirms all builds affected until patched.

These are not theoretical: PoC code for both CVEs circulates, and the vulnerability surface (multipart/form-data parsing) is exactly what attackers prefer — widely enabled, rarely audited, reachable without authentication.

Sources: Palo Alto Networks Unit 42; Rapid7 ETR; Zscaler ThreatLabz; PHP security team advisory (Oct 21, 2026); Tenable CVSS analysis.