PHP: actively exploited memory corruption allows unauthenticated remote code execution

What happened

A memory corruption vulnerability has been disclosed in PHP and is tracked as CVE-2026-109618. According to the published data, it allows an unauthenticated attacker to execute code remotely on an affected system. The vulnerability has a CVSS base score of 9.8 (critical) and is being actively exploited. The US cybersecurity agency CISA has added it to its Known Exploited Vulnerabilities catalog and has issued an alert calling for immediate patching. In some security research the issue is referred to as "PHP2Shell".

The PHP project has published a security advisory on GitHub, which is linked below.

Who is affected

Anyone running PHP on a server is potentially affected. This includes web servers with PHP-FPM or mod_php, hosting servers with several PHP versions installed through a hosting panel, and websites and web shops built on PHP-based software such as common CMS and shop systems. Servers that are reachable from the internet are at the highest risk.

The source data does not list the exact affected and fixed versions. Check the PHP security advisory linked below to see which versions are affected and which releases contain the fix.

What to do now

1. Make an inventory of every server and hosting account that runs PHP, including all PHP versions installed in parallel (for example through Plesk, cPanel or other hosting panels).
2. Open the PHP security advisory linked below and note the fixed versions for each PHP branch you use.
3. Update PHP to a fixed version using your distribution's package manager, your hosting panel or your usual update process. If your distribution provides backported fixes, check its security notice for the patched package version.
4. Restart all services that load PHP so the new version is actually in use, for example PHP-FPM and the web server (Apache, Nginx with PHP-FPM, LiteSpeed).
5. If you cannot update immediately, reduce internet exposure of the affected systems where possible and follow the mitigations in the vendor advisory. CISA advises discontinuing use of the product if mitigations are unavailable.
6. Because the flaw is actively exploited, check systems that were exposed before patching for signs of compromise: review web server and PHP-FPM logs for unusual requests or errors, look for recently created or modified PHP files in web directories, unexpected cron jobs, new user accounts and unknown running processes. CISA also refers to forensic triage requirements in its guidance.
7. If you find indications of compromise, isolate the system, preserve logs and evidence, and rotate credentials stored on the server (database passwords, API keys, SSH keys).

How to check whether you are affected

Run php -v on the command line and, where used, php-fpm -v (the binary may be named after its version, such as php-fpm8.x). On servers with several PHP versions, check each one, including those configured per site in your hosting panel. A small page calling phpinfo() shows the version a specific website actually uses; remove it again afterwards. Compare the versions you find with the affected and fixed versions in the PHP advisory. Also confirm that services were restarted after the update, since a running PHP-FPM process may still use the old code.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-109618
• https://nvd.nist.gov/vuln/detail/CVE-2026-109619