CVE-2026-109619 is a memory-safety vulnerability in how PHP resets internal state between requests that can allow an unauthenticated remote attacker to run code on the server. It is one of two vulnerabilities disclosed as PHP2Shell.

PHP keeps some internal state that temporarily points to memory used by the current request. In some cases this state is not reset when the request ends, so a later request handled by the same PHP worker can read memory that has already been freed and reused. An attacker can trigger this condition on purpose with crafted requests.

About PHP2Shell:

PHP2Shell is the name Wiz Research gave to a set of memory-safety flaws in the core PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619. Both stem from how PHP cleans up after a request ends unexpectedly, such as when it runs out of memory. Because the flaws are in PHP itself, a website can be vulnerable even if its own code is secure. Researchers demonstrated unauthenticated remote code execution on WordPress, Drupal, and Joomla, as well as reading sensitive data such as passwords and API keys from server memory.

Impact

An unauthenticated attacker can send crafted requests that run code on the server, giving them control of the website and access to its data. Any website running on an affected PHP version is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed deployments. PHP considers mod_php the highest risk, because an unauthenticated request can trigger the attack before any application code runs. Security researchers have observed exploitation attempts against both PHP2Shell vulnerabilities in the wild since October 21, 2026. Neither vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog yet.

Remediation

Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or install the patched package from your Linux distribution or hosting provider. PHP 8.1 and earlier no longer receive official updates, so upgrade to a supported version or contact your vendor for backported fixes. If you cannot update right away, PHP recommends setting session.upload_progress.enabled=0 in php.ini or server-level configuration and restarting every PHP worker. On PHP 8.5, also set fatal_error_backtraces=0. These steps block the confirmed attack paths but not every variant.