PHP2Shell (CVE-2026-109618 / 109619): critical PHP RCE, patch out today at 14:00 UTC

Two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), leaked ahead of coordinated disclosure and can allow remote code execution, possibly without authentication, prompting PHP to move its emergency release to Wednesday 21 Oct at 14:00 UTC (10:00 AM ET). Only supported branches PHP 8.2, 8.3, 8.4 and 8.5 receive fixes; PHP 8.1, 8.0, 7.x and 5.x are end-of-life and get nothing. The widely shared mitigation is setting session.upload_progress.enabled = 0 and session.use_strict_mode = 1, though a PHP core developer said "the only mitigation is patching/upgrading PHP.

Mitigation is in progress, so this quick post was generated with help of Claude Code CLI. If you run anything on PHP WordPress, Nextcloud, Matomo, phpMyAdmin, a cPanel box, that old homelab dashboard you forgot about , today is patch day. Two critical flaws in PHP core, CVE-2026-109618 and CVE-2026-109619 CVSS v4.0 9.2 , leaked ahead of coordinated disclosure. They can allow remote code execution, possibly without authentication. PHP moved its emergency release up to Wednesday 21 Oct, 14:00 UTC 10:00 AM ET and has said it may ship earlier if exploitation starts. Only supported branches get a fix = PHP 8.2, 8.3, 8.4, 8.5 . 8.1, 8.0, 7.x and 5.x are end-of-life and get nothing. If you’re on one of those, upgrading is the fix. Your distro or panel vendor Remi, CloudLinux/TuxCare, Ubuntu ESM, etc. may backport on its own schedule, but don’t count on it. The widely shared mitigation is: session.upload progress.enabled = 0 session.use strict mode = 1 It’s harmless for most sites, so it’s worth applying. But GMO Flatt expects bypasses, and a PHP core developer put it bluntly: “the only mitigation is patching/upgrading PHP.” Also check that it applies to the SAPI actually serving traffic FPM/mod php , not just the CLI: php-fpm -i | grep -E 'upload progress.enabled|use strict mode' I manage a few dozen clients servers that this would affect, so last night looked like this: Today at release: dnf/yum/apt update the PHP packages, reload FPM, confirm php -v everywhere, then watch for PHP workers spawning shells. php -v on every box, and note any EOL versions sh , curl , wget , etc. What PHP versions are you still finding in the wild?