--- title: Critical Unauthenticated Remote Code Execution Vulnerabilities in PHP description: On October 21, 2026, the National Security Agency (NSA) issued an advisory urging organizations to immediately apply newly released patches for two critical vulnerabilities in PHP, the server-side scripting language that powers a large majority of the world's public-facing websites and web applications. --- [Skip to content](https://1898advisories.burnsmcd.com/critical-unauthenticated-remote-code-execution-vulnerabilities-in-php#main-content) ![1898-logo-grey-R-1](https://1898advisories.burnsmcd.com/hs-fs/hubfs/1898-logo-grey-R-1.webp?width=188&height=100&name=1898-logo-grey-R-1.webp) - [Cyberthreat](https://1898advisories.burnsmcd.com/tag/cyberthreat) - [Threat Hunt](https://1898advisories.burnsmcd.com/tag/threat-hunt) - [View All](https://1898advisories.burnsmcd.com/) Open main navigation Close main navigation - [Cyberthreat](https://1898advisories.burnsmcd.com/tag/cyberthreat) - [Threat Hunt](https://1898advisories.burnsmcd.com/tag/threat-hunt) - [View All](https://1898advisories.burnsmcd.com/) - [Contact us](https://1898andco.burnsmcd.com/contact-us) [Contact us](https://1898andco.burnsmcd.com/contact-us) October 22, 2026 # Critical Unauthenticated Remote Code Execution Vulnerabilities in PHP ![Picture of The 1898 & Co. Team](https://1898advisories.burnsmcd.com/hs-fs/hubfs/1898%20Cyberthreat%20Advisory%20Blog%20Assets/1898-Co-Ampersand.png?width=50&name=1898-Co-Ampersand.png) [The 1898 & Co. Team](https://1898advisories.burnsmcd.com/author/1898-co-team) #### Security Advisory Brief On October 21, 2026, the National Security Agency (NSA) issued an advisory urging organizations to immediately apply newly released patches for two critical vulnerabilities in PHP, the server-side scripting language that powers a large majority of the world's public-facing websites and web applications. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published a companion alert the same day, describing the pair of flaws, collectively nicknamed "php2shell," as allowing unauthenticated remote code execution and affecting all PHP installations that serve web requests. Both agencies recommend patching without delay and taking affected systems offline if an immediate update is not feasible. The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 base score of 9.2, placing them in the critical range. CVE-2026-109618 arises from out-of-memory handling that can interrupt PHP while internal request data is only partially initialized, leaving the interpreter operating on incomplete state. CVE-2026-109619 is a use-after-free condition in which request-owned internal state can persist and be referenced after the memory backing it has already been freed. In both cases, an attacker can reach the flawed code paths remotely, without any authentication, by sending a crafted web request, and can achieve code execution in the context of the PHP worker process serving the application. Because PHP underpins the majority of content management systems, e-commerce platforms, and custom web applications in production today, the potential exposure is exceptionally broad. The PHP development team shipped fixes on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and all earlier branches have reached end of life and will not receive a patch. CISA reported that it had not observed exploitation of these vulnerabilities as of publication; however, proof-of-concept activity and early exploitation attempts against internet-facing servers have already been reported, so the window for unpatched organizations to act is narrow. #### Threats and Vulnerabilities CVE-2026-109618, with a CVSS v4.0 score of 9.2, is an initialization flaw in the PHP request-handling path. When PHP encounters an out-of-memory condition, the resulting interruption can occur while the interpreter has only partially initialized internal request data structures. An attacker who can influence memory pressure and request timing may drive the interpreter to operate on this incompletely initialized state, corrupting memory in a controllable way. Because the affected code path is reached while PHP services an ordinary web request, exploitation requires no credentials, no user interaction, and no prior foothold—only the ability to send requests to a PHP-backed endpoint. Successful exploitation yields remote code execution within the PHP worker process, from which an attacker can read application data, write files such as web shells, or pivot deeper into the hosting environment. CVE-2026-109619, also rated at a CVSS v4.0 score of 9.2, is a use-after-free vulnerability in PHP's internal request state management. Under specific conditions, internal state that is owned by a single request can survive beyond the point at which its backing memory has been freed, so that a later operation references a dangling pointer. An attacker who shapes requests to trigger and then reuse the freed structure can corrupt the interpreter's memory and redirect execution. As with the companion flaw, the vulnerable path is exposed to unauthenticated remote requests, and reliable exploitation grants code execution in the context of the web application. Both issues are reachable in default-style web deployments rather than requiring an uncommon configuration, which is why the NSA and CISA have framed them as an immediate, enterprise-wide patching priority. #### Client Impact For most organizations, PHP is not a single application to be patched but a dependency embedded throughout the web estate—in public websites, customer and partner portals, internal tools, and third-party software that bundles its own PHP runtime. A successful unauthenticated remote code execution against an internet-facing PHP server can give an attacker an immediate foothold with the privileges of the web service account, enabling web shell installation, theft of application secrets and database credentials, defacement, or use of the server as a staging point for lateral movement. Operational technology and critical infrastructure operators are not exempt: engineering portals, historian dashboards, device management consoles, and vendor-supplied maintenance interfaces frequently run on PHP, and a compromise of one of these web front ends can expose a path toward more sensitive operational networks. From a compliance and regulatory standpoint, the combination of a critical CVSS v4.0 score, confirmed unauthenticated remote code execution, and explicit federal advisories from both the NSA and CISA elevates these vulnerabilities to a clear and documentable obligation to act. Frameworks and mandates such as PCI DSS, HIPAA, the NIST Cybersecurity Framework, and sector-specific regulations including NERC CIP generally require timely remediation of known critical vulnerabilities on in-scope systems, and an unpatched, externally reachable PHP server would likely be cited as a finding in any audit or assessment. A breach originating from a publicly disclosed, patch-available flaw of this severity also carries heightened breach-notification exposure and reputational risk. #### Mitigations The following actions are recommended to reduce exposure to these vulnerabilities and should be prioritized according to internet exposure and system criticality: 1. Inventory every system that runs PHP, including PHP embedded inside third-party and vendor-supplied software, container images, and web application appliances, so that no instance is overlooked during remediation. 2. Apply the vendor-released patches immediately, updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as appropriate for each branch, and prioritize internet-facing and externally reachable systems first. 3. Where an immediate update is not feasible, take the affected PHP-based system offline until it can be patched, and apply web application firewall rules as an interim measure rather than a substitute for patching. 4. Identify and retire or isolate systems running PHP 8.1 or earlier, which are end of life and will not receive a fix; migrate these workloads to a supported, patched branch on an accelerated timeline. 5. Monitor for post-exploitation activity, including PHP worker processes that spawn command shells or download external tooling, newly created or modified script files in web-accessible directories, and anomalous outbound connections from web servers, and hunt for web shells across the PHP estate. Applying these mitigations promptly, with internet-facing systems addressed first, substantially reduces the likelihood and impact of exploitation while longer-term inventory and lifecycle improvements are completed. #### 1898 & Co. Response 1898 & Co. works alongside organizations to manage vulnerabilities of this kind across both enterprise IT and operational technology environments. Our security teams have experience helping clients rapidly inventory affected software, assess real-world exposure, and sequence remediation so that the systems most at risk—internet-facing and business-critical PHP applications—are addressed first. For a fast-moving disclosure such as the php2shell vulnerabilities, that structured triage helps organizations act on the NSA and CISA guidance within the short window before exploitation becomes widespread. Beyond immediate patching support, 1898 & Co. provides managed threat detection and response through its Managed Security Services, drawing on continuous monitoring to identify the post-exploitation behaviors these flaws enable, such as web shell deployment, unexpected process execution by web services, and outbound connections indicative of tool staging or data exfiltration. Our analysts can help validate whether a PHP server was targeted before patching completed and support containment and recovery where evidence of compromise is found. For asset owners in critical infrastructure and industrial sectors, 1898 & Co. brings experience spanning both information technology and operational technology, recognizing that PHP-based engineering and management interfaces can sit at the boundary between corporate and operational networks. We work with clients to reduce the exposure of these web front ends, strengthen segmentation around them, and align remediation with operational constraints so that security improvements are achievable without unplanned downtime. #### Sources 1. [NSA Advisory — Critical Patches Recommended for PHP Vulnerabilities](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/) 2. [CISA Alert — Critical Vulnerabilities in PHP Require Immediate Patching](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) 3. [PHP Project — Security Advisories (php-src)](https://github.com/php/php-src/security/advisories) 4. [NVD Entry — CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) 5. [NVD Entry — CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619) [Cyberthreat](https://1898advisories.burnsmcd.com/tag/cyberthreat) *The information in this cybersecurity advisory is provided "as is" for informational purposes only. 1898 & Co. does not provide any warranties or guarantees of any kind regarding this information. You assume all risks if you choose to rely on this information. In no event shall 1898 & Co. or its contractors or subcontractors be liable for any damages including, but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with, this information, whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance upon the information* *1898 & Co. does not endorse any product or service, except as expressly stated otherwise. Any reference to products or processes does not constitute or imply 1898 & Co.’s endorsement or recommendation.* Subscribe ✕ Close   [Accessibility](https://1898andco.burnsmcd.com/accessibility)  |  [Privacy Statement](https://1898andco.burnsmcd.com/privacy) © 2026 1898 & Co., a part of Burns & McDonnell. All Rights Reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "The 1898 & Co. Team", "url" : "https://1898advisories.burnsmcd.com/author/1898-co-team" }, "dateModified" : "2026-10-22T14:32:09.772Z", "datePublished" : "2026-10-22T14:32:09.000Z", "headline" : "Critical Unauthenticated Remote Code Execution Vulnerabilities in PHP", "mainEntityOfPage" : { "@id" : "https://1898advisories.burnsmcd.com/critical-unauthenticated-remote-code-execution-vulnerabilities-in-php", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "//cdn2.hubspot.net/hub/477837/file-2585615236-jpg/Logo_1_Primary_2Color1.jpg" }, "name" : "Burns & McDonnell Engineering Co" } } ```