PHP2Shell: two critical bugs in the PHP runtime, patched October 21

On 21 October 2026, the PHP project patched⁠ (opens in new tab) two critical bugs in PHP, the software many websites run on. Those bugs sit in the PHP runtime itself, and they allow an attacker who is not logged in to run code on the server. To close that hole, operators need to update PHP itself to a patched version, not the site's own application code. Industry write-ups call the two bugs PHP2Shell.

Background

Wiz⁠ (opens in new tab) showed those bugs on the latest packaged versions of WordPress, Drupal, and Joomla, three common tools for running a website on PHP (container images). Calif⁠ (opens in new tab) also puts Magento in that same group.

On the PHP project's own records, the bugs sit in versions 8.2 through 8.5. If you run one of those versions, you need the official security update the PHP project shipped for it. Wiz, Calif, and Cloudflare's WAF write-up say older PHP can be affected too, back to 5.4.

Calif began Patch the Planet on 30 July 2026, an audit of PHP's own code. OpenAI⁠ (opens in new tab) and Wiz independently reported related ways an attacker can run code on the server. The PHP Foundation⁠ (opens in new tab) posted how the public patches were timed and released together.

What happened

Advisory on 21 October 2026

On 21 October 2026, php.net⁠ (opens in new tab) posted two critical unauthenticated RCEs (remote code execution: running code on the server) in PHP and told operators to update now. The advisory says every install that serves web requests is at risk, including PHP-FPM and Apache with mod_php. It puts the highest risk on mod_php, and says a demonstrated exploit can trigger before any application code runs.

The two CVEs

Those two bugs are tracked as two CVEs, public IDs for security bugs. CVE-2026-109618⁠ (opens in new tab) is remote code execution through out-of-memory corruption (OOM): the PHP process runs out of memory, that memory is corrupted, and that can be used to run code (GHSA-w8hw⁠ (opens in new tab)). CVE-2026-109619⁠ (opens in new tab) is remote code execution through stale global state: leftover internal PHP state that can be reused to run code (GHSA-6wmf⁠ (opens in new tab)).

Those two CVEs also get a severity score: a 0-10 rating of how serious the bug is, on a system called CVSS. The PHP Group rates both bugs 9.2. They used CVSS version 4.0 for that rating. NVD, the US National Vulnerability Database, scores the same two bugs with CVSS version 3.1, an older edition of that 0-10 system. It scores the two CVEs differently: NVD's 109618⁠ (opens in new tab) score is 9.8 after a completed review (Analyzed), and NVD's 109619⁠ (opens in new tab) score is 8.1 after NVD updated the record (Modified).

Patched versions

Fixed builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.6.0 RC4 has the same fixes but is not for production. PHP 8.1 and older do not get an official patched download from the PHP project. Limited source-code patches exist for 7.4, 8.0, and 8.1, and some Linux distributions and long-term-support vendors ship their own packages with the fix. Workarounds can lower the risk, but the complete fix is to update PHP to a patched version.

Pre-announcement on 20 October

On 20 October 2026, php.net posted a pre-announcement⁠ (opens in new tab) of a critical security release for 21 October 2026, 14:00 UTC. The PHP Foundation⁠ (opens in new tab) said the CVE IDs leaked on 20 October, and that Chainguard published ready-to-run PHP images more than six hours before that embargo lifted, the hold that was supposed to keep patch details private until the public release. That gap could give an attacker time to study the fix while most sites still had no official patched download.

Exploitation status

CISA⁠ (opens in new tab) has not observed exploitation as of publication. Neither CVE was listed in CISA's Known Exploited Vulnerabilities catalog (KEV) as of 23 October 2026. Amazon Threat Intelligence⁠ (opens in new tab) recorded an attempt on 17 October 2026 on MadPot, a decoy system Amazon uses to watch attacks (a honeypot). It later recorded further attempts, including broad attempts after the 21 October 2026, 14:00 UTC disclosure, and says it is unclear whether those attempts would have succeeded on real-world systems. Cloudflare's CEO said on X⁠ (opens in new tab) that attempt counts rose around the public announcement; those figures count attempts, not successes. Sophos corrected⁠ (opens in new tab) an earlier successful-exploitation claim; as of 22 October 2026 it reported no evidence of a successful compromise.

Cloudflare WAF from 21 October

Cloudflare⁠ (opens in new tab) turned default web application firewall (WAF) protections on for free and paid customers from 21 October 2026, 03:02 UTC. Customers should patch PHP even with those rules on. A 22 October changelog⁠ (opens in new tab) renamed metadata on seven named rules. CISA says a WAF may give organizations some protection until they update. It is not a substitute for a patch.

Who it affects

Site operators and hosts

CISA's PHP alert⁠ (opens in new tab) is for organizations and admins, not wallet users. It tells operators to find every PHP install and patch immediately, with internet-facing systems first. The same alert says installs on 8.1 or older, or any stack that cannot be updated, should be taken offline until a patched build is in place.

Web3 platforms that spoke

On 21 October 2026, Coinbase CSO Jeff Lunglhofer said on X⁠ (opens in new tab) that Coinbase checked its systems and found no evidence of any exposed PHP instances. BitGo posted⁠ (opens in new tab) the same day that its platform is not impacted. SlowMist⁠ (opens in new tab) posted that crypto platforms should assess risk and upgrade to official patched versions.

On 22 October 2026, Binance⁠ (opens in new tab) posted that it implemented safeguards before the official patch and completed the necessary remediation. That wording does not say whether Binance ran a vulnerable PHP version. Trust Wallet⁠ (opens in new tab) posted that its wallet apps and core infrastructure are not built on PHP, that users are unaffected, and that no action is required. That statement is about Trust Wallet's own apps. BNB Chain posted on X⁠ (opens in new tab) that its tech stack does not use PHP and that the network and core infrastructure are unaffected.

Games, marketplaces, and launchers

No game, marketplace, or launcher in the sources for this article reported being affected, patched, or compromised.

General good practice

These checks are general good practice. They are not a claim that PHP2Shell targets wallets.

CISA's Recognize and Report Phishing⁠ (opens in new tab) page lists common tricks: messages that rush you, short links that hide the real address, and sites that look like a brand you know. It recommends typing the address or opening the verified site yourself.

Keep browsers and apps updated.

Check the site URL in the address bar before you connect a wallet. Treat an unexpected wallet prompt as untrusted.

Skip unsolicited DMs and look-alike handles that send you to a signing page. If a familiar site looks or behaves unusually, wait rather than sign. Prefer an official bookmark over a search-result or chat link when you open a site to use a wallet.

At a glance

Item	Detail
What	Two critical unauthenticated RCEs in PHP (CVE-2026-109618, CVE-2026-109619)
Patched versions	8.5.12, 8.4.27, 8.3.36, 8.2.35
Older PHP	No official 8.1-or-older release; source backports 7.4, 8.0, and 8.1
Advisory day	21 October 2026
Release time	21 October 2026, 14:00 UTC
CISA as of publication	Has not observed exploitation
KEV (checked 23 October 2026)	Neither CVE listed
Cloudflare WAF	Default on from 21 October 2026, 03:02 UTC; patching is required

On Web3Raider

Closest pages:

Hub: Games, NFT, Blockchain
BNB Chain

Check whether CISA adds CVE-2026-109618 or CVE-2026-109619 to the Known Exploited Vulnerabilities catalog (KEV feed⁠ (opens in new tab)).
Look for distro, host, and WAF vendor patch notes for PHP 8.1 or older and for managed PHP.
Follow first-party statements from the Web3 sites, marketplaces, and launchers you actually use.

Bottom line: If you run a PHP website, check the version and move to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and take unpatchable 8.1-or-older hosts offline.

PHP2Shell: two critical bugs in the PHP runtime, patched October 21

Background