If you are running production PHP servers, drop everything and update. The PHP security team has released emergency patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical Remote Code Execution (RCE) vulnerabilities collectively nicknamed "PHP2Shell." These flaws carry a CVSS v4.0 score of 9.2, indicating a severe threat level that allows unauthenticated attackers to potentially take over entire servers and sites.

The Technical Breakdown

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. The first involves out-of-memory corruption during request initialization, while the second relates to stale global state survival. These aren't just minor bugs; they provide a direct path for attackers to execute arbitrary code without needing valid credentials. The urgency was heightened after technical details and exploit tool screenshots leaked ahead of the official release, reportedly via security firms like watchTowr and Sansec.

Immediate Action Required

For those managing infrastructure, the path forward is clear. You must update to the latest patched versions through your package manager or directly from PHP's official downloads. Crucially, do not forget to restart your PHP-FPM, Apache/mod_php, or other worker processes after updating; the patch won't take effect in memory otherwise. If you cannot patch immediately, PHP recommends setting session.upload_progress.enabled=0 in php.ini (not via ini_set) and configuring rigid memory limits (memory_limit=-1 via admin value) as temporary mitigations.

The Legacy Version Trap

A significant concern for many organizations is the status of PHP 8.1 and older versions. Since these branches are past their active support lifecycle, they will not receive standard official updates from the PHP core team. If you are stuck on these older versions, you must check with your OS vendor or LTS provider for backported fixes. Alternatively, consider minimal source backports if you build from source, but the most robust solution is to plan an immediate upgrade to a supported branch.

Key Takeaways

  • Emergency patches released for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • CVEs 2026-109618 and 2026-109619 carry a CVSS score of 9.2.
  • Unauthenticated RCE is possible, leading to full server takeover.
  • PHP 8.1 and older require vendor-specific backports or immediate upgrades.
  • Restart worker processes after updating to ensure patches are active.

The Bottom Line

This is a code-red situation for PHP infrastructure. Do not wait for the next scheduled maintenance window; patch immediately and restart your workers, because an unauthenticated RCE with a 9.2 score is a breach waiting to happen.