# PHP2Shell (CVE-2026-109618 / 109619): critical PHP RCE, patch out today at 14:00 UTC > Source: > Published: 2026-10-21 13:18:48+00:00 *Mitigation is in progress, so this quick post was generated with help of Claude Code CLI.* If you run anything on PHP (WordPress, Nextcloud, Matomo, phpMyAdmin, a cPanel box, that old homelab dashboard you forgot about), today is patch day. Two critical flaws in PHP core, **CVE-2026-109618** and **CVE-2026-109619** (CVSS v4.0 **9.2**), leaked ahead of coordinated disclosure. They can allow remote code execution, possibly without authentication. PHP moved its emergency release up to **Wednesday 21 Oct, 14:00 UTC (10:00 AM ET)** and has said it may ship earlier if exploitation starts. Only supported branches get a fix! = **PHP 8.2, 8.3, 8.4, 8.5**. **8.1, 8.0, 7.x and 5.x are end-of-life and get nothing.** If you’re on one of those, upgrading is the fix. Your distro or panel vendor (Remi, CloudLinux/TuxCare, Ubuntu ESM, etc.) *may* backport on its own schedule, but don’t count on it. The widely shared mitigation is: ``` session.upload_progress.enabled = 0 session.use_strict_mode = 1 ``` It’s harmless for most sites, so it’s worth applying. But GMO Flatt expects bypasses, and a PHP core developer put it bluntly: *“the only mitigation is patching/upgrading PHP.”* Also check that it applies to the SAPI actually serving traffic (FPM/mod_php), not just the CLI: ``` php-fpm -i | grep -E 'upload_progress.enabled|use_strict_mode' ``` I manage a few dozen clients servers that this would affect, so last night looked like this: Today at release: `dnf/yum/apt update` the PHP packages, reload FPM, confirm `php -v` everywhere, then watch for PHP workers spawning shells. `php -v` on every box, and note any EOL versions`sh`, `curl`, `wget`, etc. What PHP versions are you still finding in the wild?