CVE-2026-109618 is 1 of the 2 PHP2Shell flaws in PHP, rated critical (CVSS v4.0 9.2). A memory error while PHP reads form data can let an attacker run their own code. PHP fixed it on October 21, 2026 in 8.2.35, 8.3.36, 8.4.27, 8.5.12; earlier releases on those lines have it, and PHP 8.1 and older got a source-code fix only.
- CVSS v4.0 score, rated critical
- 9.2
- fixed releases out
- Oct 21, 2026
- PHP lines with a fixed release
- 4
What is CVE-2026-109618?
A memory error while PHP reads form data can let an attacker run their own code. It's 1 of 2 flaws known together as PHP2Shell; the other is CVE-2026-109619. PHP fixed both on October 21, 2026.
- In technical terms: Remote code execution via out-of-memory corruption during request parsing.
- Severity: CVSS v4.0 9.2, rated critical.
- Advisory: GitHub GHSA-w8hw-w9fx-j79w.
- Where it runs: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
Which PHP versions are affected by CVE-2026-109618?
| PHP line | Affected releases | Fixed in |
|---|---|---|
| PHP 8.5 | 8.5.0 to 8.5.11 | 8.5.12 |
| PHP 8.4 | 8.4.0 to 8.4.26 | 8.4.27 |
| PHP 8.3 | 8.3.0 to 8.3.35 | 8.3.36 |
| PHP 8.2 | 8.2.0 to 8.2.34 | 8.2.35 |
| PHP 7.4 | All (end of life) | Source-code fix only, no release |
| PHP 8.0 | All (end of life) | Source-code fix only, no release |
| PHP 8.1 | All (end of life) | Source-code fix only, no release |
What to do
- Find out whether your website runs PHP, and which version. PHP Scanner shows what your server reports.
- Ask your host or developer to update to the fixed release for your line (8.2.35, 8.3.36, 8.4.27, 8.5.12) and restart PHP.
- If you're on PHP 8.1 or older, plan a move to a supported version.
- If you can't update today, ask about PHP's temporary workarounds below.
Temporary workarounds for CVE-2026-109618
These close only some attack paths. Updating PHP is the only full fix. Restart every PHP worker after each change.
Remove the per-request memory limit with a setting the app cannot override (php_admin_value), and enforce request size limits at the web server or proxy instead.
php_admin_value[memory_limit] = -1
Keep post_max_size small (8M with no uploads, 32M with uploads) and upload_max_filesize below it.
post_max_size = 8M
Is it being exploited?
Proof-of-concept code is reportedly public, and security researchers reported attempts to use it within days of the fix.
Questions people ask
Is my website affected by CVE-2026-109618?
Only if it runs PHP from before the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Sites on hosted platforms like Shopify or Webflow don't run PHP you manage.
Does updating WordPress fix CVE-2026-109618?
No. The flaw is in PHP, which your host or developer updates. Keep WordPress updated too, but it's a separate job.
What's the difference between CVE-2026-109618 and CVE-2026-109619?
A memory error while PHP reads form data can let an attacker run their own code. Leftover state from 1 request can be reused by the next, letting an attacker run code. Both are fixed by the same PHP releases.
Sources
- PHP: security release announcement, October 21, 2026
- The PHP Foundation: today's PHP security release
- GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- Canadian Centre for Cyber Security: AL26-026
- Datadog Security Labs: PHP2Shell analysis
- The Hacker News: exploit attempts reported
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.