Last Updated: October 23, 2026

Two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and called PHP2Shell, can let a remote caller run code on an affected PHP worker without signing in.

PHP is the server-side language behind a large share of the web, often estimated at about 70% of sites that run a known server-side language. Online stores, company sites, and WordPress are in that set. The practical impact is the site and the files that PHP process can reach, not a magic key to every machine on the internet.

This short video is a walkthrough of the blast radius:

1. What happened

The PHP project shipped emergency releases on October 21, 2026, after details began circulating ahead of a coordinated disclosure that had been aimed at October 22.

Both issues sit in request handling. One is triggered when memory runs out while PHP is still building the request, and later cleanup touches state that was never finished. The other is triggered when a fatal error interrupts cleanup and leaves a stale pointer. An attacker does not need an account on the site.

Apache with mod_php is the deployment the PHP project treats as the highest risk. PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed are affected too. Reliable exploitation still depends on the process layout, but unauthenticated code execution is the issue vendors are patching for.

2. Which versions to update

The complete fix is a patched PHP release. Upgrade, then restart the PHP workers so the new binary is the one serving traffic.

• PHP 8.5: fixed in 8.5.12. Affected builds are 8.5.0 through 8.5.11.
• PHP 8.4: fixed in 8.4.27. Affected builds are 8.4.0 through 8.4.26.
• PHP 8.3: fixed in 8.3.36. Affected builds are 8.3.0 through 8.3.35.
• PHP 8.2: fixed in 8.2.35. Affected builds are 8.2.0 through 8.2.34.

PHP 8.1 and older, including 7.x and 5.4 and later in that line, have no upstream binary release for CVE-2026-109618. Some Linux vendors have shipped their own packages. If your internet-facing server is still on an end-of-life PHP and you cannot apply a vendor fix today, take that site offline until you can move it to a patched release.

AWS, Red Hat, and Ubuntu have published their own guidance. Reporting has also said the NSA warned operators to patch. Configuration changes are not a substitute for the upgrade.

3. How the flaws were found

OpenAI's Patch the Planet effort was part of the response. Calif identified one of the flaws with GPT-5.6 Sol. Wiz also reported the issues independently. PHP's maintainers led the fixes and the release.

The early leak is why the patches arrived as an emergency rather than on the original disclosure date. Scanning for unpatched servers started as soon as the details were public.

4. What to do now

• Upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or to the patched package from your Linux vendor or host, and restart PHP.
• Inventory every place PHP is running, including appliances and software that bundles its own PHP, not only the version you installed for the shop.
• If the server is on PHP 8.1 or older and no vendor package is available, do not leave it on the public internet while you plan the move.

A store that is only a pile of PHP plugins will keep having days like this. The patch is still the first job. The longer job is not to make the next emergency the same shape.

5. FatLeon Commerce

FatLeon Commerce is proprietary source code you deploy in your own AWS account. The shop does not run on PHP, so this PHP release does not patch it and this bug does not live in it.

There is one codebase and two licenses. The purchase is one-time. Paddle.com is the merchant of record.

• Standard: stores you operate. https://fatleon.com/product/fatleon-standard-license
• Agency: stores you also build for clients. https://fatleon.com/product/fatleon-agency-license

The license file in the zip governs use. Questions about an order go to info@fatleon.com.