Site owners can reduce their exposure to two critical PHP memory corruption flaws by checking the production PHP version today, applying the relevant vendor update and accounting for public exposure. The flaws are CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell.
The National Security Agency recommended immediate attention to vulnerable PHP services because an unauthenticated attacker may be able to take control of an affected server.
What happened
According to OpenAI’s coordinated disclosure account, PHP maintainers released fixes for two memory corruption vulnerabilities found through work involving OpenAI, calif.io and Wiz. Red Hat’s October 2026 security bulletin says an unauthenticated remote attacker can trigger memory corruption during PHP request processing, potentially leading to arbitrary code execution.
CVE-2026-109618 can leave incomplete request state uninitialized after a failed memory allocation. CVE-2026-109619 can leave stale pointers after a fatal error interrupts cleanup. Red Hat says reliable exploitation requires precise heap manipulation and timing, while Cisco’s October 2026 advisory reported no malicious use known to its product security incident response team at publication.
Are you affected?
The UK National Cyber Security Centre says all PHP versions may be affected, so owners should identify PHP installations generally rather than assume only old releases are exposed. Red Hat says systems without PHP, or systems that do not expose PHP to untrusted HTTP requests, are outside this advisory’s affected scope.
Ask the host or developer for the PHP version running on the live site, then compare it with the fixed release for the PHP branch in use. The PHP security information listed by the protection project identifies fixed releases of PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while noting that PHP 8.1 and earlier are out of upstream support.
Red Hat reports that PHP-FPM workers exit on early initialization failures before reaching the corrupted structures, making remote code execution difficult in practice, while environments running mod_php with default configuration are at higher risk.
Red Hat lists Red Hat Enterprise Linux 8, 9 and 10 and Red Hat OpenShift Dev Spaces 3 as directly affected. It also says Red Hat products supported on RHEL, including RHEL CoreOS and products based on RHEL or UBI container images, may be affected. Cisco said on October 22 that it was still investigating its product line and had not yet identified affected products.
What to do now
- Confirm the live PHP version. Ask the host or developer for the version serving the public website, not the version installed on a development computer.
- Apply the applicable vendor update. Follow the upstream PHP advisory and the operating-system or hosting provider’s update channel, since a distribution may backport the security fix.
- Check the active PHP setup. Ask the provider whether the site uses PHP-FPM or mod_php.
- Set the patch urgency from exposure and impact. CISA’s BOD 26-04 uses asset exposure, Known Exploited Vulnerabilities status, exploit automation and technical impact to decide whether remediation should be immediate or scheduled.
If the system cannot be updated promptly, the NSA recommends taking it offline until it can be mitigated. It also advises adding operational and network logging and replacing end-of-life PHP services that cannot receive compatible patches.
What we’re seeing
Why the response model matters
The PHP response involved maintainers, researchers, hosting and security providers, and government cyber agencies. OpenAI’s disclosure describes five stages: validate and fix the flaw, give affected organizations time to prepare, coordinate with government partners, prepare product updates and publish deployment guidance after a patch is available.
The OpenAI disclosure says calif.io found a critical flaw with GPT-5.6 Sol through Patch the Planet, while Wiz independently discovered and reported both vulnerabilities. It also states that PHP maintainers led the fixes and release, supported by research and coordination from OpenAI, Wiz, Cloudflare and other partners.
OpenAI says it committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders for organizations with limited security resources protecting essential services. The disclosure names the White House’s Super Intelligence Force, the Office of the National Cyber Director and the Cybersecurity and Infrastructure Security Agency among the government participants. OpenAI’s PHP version checker was released as a Codex skill to help operators identify potentially vulnerable versions and applicable updates.
What we could not confirm
The source material does not provide primary confirmation for additional Patch the Planet model details or a separate Daybreak announcement beyond that disclosure.
FAQ
Are all PHP websites affected by CVE-2026-109618 and CVE-2026-109619?
The UK National Cyber Security Centre says all PHP versions may be affected and advises organizations to update to the latest fixed version. Red Hat says systems without PHP or systems that do not expose PHP to untrusted HTTP requests are not affected by these flaws.
What PHP versions contain the October 2026 fixes?
The PHP security information identifies 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as fixed releases. PHP 8.1 and earlier are out of upstream support, although supported vendors may provide backported fixes.
Should a site use PHP-FPM or mod_php?
Red Hat says standard Red Hat Enterprise Linux deployments use PHP-FPM, whose workers exit on early initialization failures before reaching the corrupted structures. Red Hat says environments running mod_php with default configuration are at higher risk.
Sources
See our editorial disclaimer for how our articles are produced.
Run a free scan to see your AI Visibility Score, SEO rating, and local citation accuracy.