Two critical remote code execution flaws in PHP! ALERT Websites taken down worldwide as critical cyber-security update VITAL!

Two critical remote code execution flaws in PHP, dubbed “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619), forced governments and major organizations worldwide to take websites offline on Wednesday, October 21, 2026, as the language powers roughly 70% of the internet. The vulnerabilities, rated 9.2/10 on the CVSS scale, allow attackers to execute code on servers without authentication or a password, potentially stealing credentials, API keys, and user data.

PHP2Shell comprises two critical remote code execution (RCE) vulnerabilities (CVSS 9.2) tracked as CVE-2026-109618 and CVE-2026-109619. They affect all PHP versions serving web requests across PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP project released emergency patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. [1, 2]

The Vulnerabilities

• CVE-2026-109618: An out-of-memory (OOM) error handling flaw. If PHP runs out of memory while setting up request data, the process interrupts and treats partially initialized data as valid, leading to RCE. [1, 2]

• CVE-2026-109619: A stale global state flaw where request-specific internal state survives after its memory is freed. A subsequent request handled by the same worker can misuse that stale data before initialization resets it. [1, 2]

• Highest Risk: Setups using Apache with mod_php are considered most vulnerable, allowing unauthenticated attackers to execute arbitrary code before any application code runs. [1, 2]

How to Fix & Mitigate

• Update Immediately: Upgrade your PHP runtime to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or apply backported packages from your Linux distribution or long-term support (LTS) vendor. [1]

• Apply WAF / Edge Rules: Deploy web application firewall rules (such as those provided by Cloudflare) to block oversized POST bodies or suspicious payloads. [1, 2]

• Isolate Unpatched Systems: If an instance cannot be patched right away (such as end-of-life PHP branches), CISA and the NCSC advise taking the affected system offline or restricting public network access behind a VPN or firewall. [1, 2]

SO NOW I HAVE TO FIGURE OUT HOW TO UPGRADE TO 8.5.12 - CWP ONLY HAS UP TO VERSION 8.5.9