What are CVE-2026-109618 and CVE-2026-109619?

Two critical vulnerabilities in PHP, nicknamed PHP2Shell, disclosed by the PHP project on 21 October 2026. Both can let an attacker run their own code on a web server without logging in. CVE-2026-109618 is memory corruption during out-of-memory handling, and CVE-2026-109619 is a use-after-free caused by state left over between requests.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer receive official releases, but the PHP security team published source backports for 7.4, 8.0, and 8.1, and vendors such as cPanel ship patched packages for those versions.

Are WordPress sites affected?

Yes, if the server's PHP is not updated. The flaws are in PHP itself, not in WordPress or any plugin, so any PHP website can be attacked, and an attack can start before the site's own code even runs. Updating PHP on the server is the fix.

Do Register.rw hosting customers need to do anything?

No. Every Register.rw hosting server has been updated with cPanel's patched PHP packages. We still recommend running PHP 8.2 or newer and keeping WordPress, themes, and plugins up to date.

Is PHP2Shell being exploited?

Yes. Security companies have reported exploitation attempts in the wild, and exploit code is circulating publicly. Any server that has not been updated should be patched immediately.

What if I can't update PHP straight away?

The PHP project lists temporary mitigations, such as disabling session upload progress and limiting POST size, but says updating is the only complete fix. Treat mitigations as a stopgap for hours, not weeks.

PHP2Shell: CVE-2026-109618 and CVE-2026-109619 Explained

The Short Version

On 21 October 2026, the PHP project released emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, together nicknamed PHP2Shell. Both let an attacker run their own code on a web server without logging in, and both are rated critical (CVSS 9.2). Exploitation attempts are already being reported.

Who is affected: any server running PHP to serve websites, which includes most WordPress, Joomla, Laravel, and custom PHP sites.
The fix: update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or install your vendor's patched package, then restart PHP.
Register.rw customers: all our hosting servers are already patched. You don't need to do anything.

What Went Wrong, in Plain Language

PHP handles each visit to a website as a "request". Between requests, it is supposed to clean up completely, so nothing from one visit can affect the next. Both flaws break that promise.

CVE-2026-109618: out-of-memory corruption

When PHP runs out of memory, it stops what it's doing immediately. If that happens while PHP is halfway through setting up its internal data, the cleanup that follows can treat the half-built data as if it were valid. An attacker who can deliberately push PHP out of memory at the right moment can turn that confusion into running their own code.

CVE-2026-109619: stale state between requests

Some of PHP's internal state can survive after the memory behind it has been freed. The next request handled by the same PHP worker can then use that stale data before it is properly reset. This is a classic use-after-free bug, and it can also leak parts of the server's memory.

The PHP project considers the risk highest for Apache with mod_php, where a single unauthenticated request can trigger the attack before any of the website's own code runs. PHP-FPM, php-cgi, LiteSpeed, and FrankenPHP are all affected too.

Which Versions Are Affected and Fixed

The vulnerable code dates back to PHP 5.4, so effectively every PHP version in use today is affected until it's patched.

Your PHP version	What to do
8.5	Update to 8.5.12
8.4	Update to 8.4.27
8.3	Update to 8.3.36
8.2	Update to 8.2.35
7.4, 8.0, 8.1	No official release. Install your vendor's patched package (cPanel, CloudLinux, and Linux distributions ship backports), or upgrade to 8.2 or newer
7.3 and older	No fix from the PHP project. Upgrade

Is It Being Exploited?

Yes. Security companies, including Tenable and watchTowr, have reported attacks against unpatched servers, and exploit code is circulating publicly. The UK's National Cyber Security Centre advised considering taking vulnerable systems offline if they can't be patched quickly. Treat any unpatched PHP server as urgent.

Register.rw Customers: You're Already Protected

Every Register.rw hosting server has been updated following cPanel's guidance for this release, using cPanel's patched PHP packages, including the backported fixes for older PHP versions. We confirmed the fix is installed on each server. No action is needed on your side.

Two things are still worth doing, because they protect you against the next vulnerability too:

Run PHP 8.2 or newer. Open cPanel, go to MultiPHP Manager, and check which version each of your sites uses. Older versions no longer get regular security fixes from the PHP project. If you're not sure whether your site works on a newer version, message us on WhatsApp and we'll help you test it.
Keep WordPress, themes, and plugins updated. PHP2Shell is in PHP itself, but most hacked sites are still hacked through outdated plugins. See WordPress security best practices.

If You Run Your Own Server

If you manage PHP yourself, on a VPS or your own hardware:

Update PHP to one of the fixed versions above, through your operating system's packages or your control panel:
- cPanel: apply the EasyApache 4 updates in WHM, or let the nightly update run, so the patched ea-php packages are installed.
- CloudLinux PHP Selector (alt-php): update the alt-php packages too. They are patched separately from cPanel's ea-php.
- Ubuntu, Debian, RHEL, and AlmaLinux: install your distribution's security update for PHP.
Restart PHP (Apache, PHP-FPM, or LiteSpeed). Old PHP workers keep running the vulnerable code until they are restarted.
Check the result. Run php -v and check each website's PHP version, not just the command-line one. On cPanel, the package changelog mentions the CVE once the fix is installed: rpm -q --changelog ea-php83-php-cli | grep CVE-2026-109618.

If you can't update right away

The PHP project lists temporary mitigations, but is clear that updating is the only complete fix:

For CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini or the server configuration, then restart every PHP worker. Setting it with ini_set() or a .user.ini file is not enough. On PHP 8.5, also set fatal_error_backtraces=0.
For CVE-2026-109618, keep post_max_size low (8M if you don't need uploads, 32M if you do), and see PHP's advisory for its full memory guidance.

Use these for hours, not weeks.

Could Your Site Already Be Compromised?

If a server ran unpatched PHP after 21 October 2026, check it. Warning signs include unfamiliar PHP files in your website folders, new admin users, unexpected redirects or spam pages, and unusual outgoing email. Our guide on recovering a hacked WordPress site walks through the clean-up, and common website server attacks explains what attackers typically do once they get in.

Register.rw hosting customers who notice anything unusual can reach us on WhatsApp at +250 798 655 361, 24/7, in English or Kinyarwanda.

Sources

PHP project security announcement, 21 October 2026: php.net
CVE-2026-109618 advisory: GHSA-w8hw-w9fx-j79w
CVE-2026-109619 advisory: GHSA-6wmf-4rv5-p3rp
CloudLinux package status: CloudLinux blog
Exploitation reports: Tenable