PHP Patches Two Critical RCE Flaws After Exploit Code Appears Online

Test attack code for two serious PHP flaws showed up online on October 21, 2026. PHP is a popular language that helps people build websites and web apps. The code appeared before the planned security fix went live. That gave website owners less time to protect their servers.

Attack Code Surfaces Online Before the Patch

Security researchers were already tracking the two flaws when the code appeared. The release worried many people. Attackers could try to use the flaws before administrators had a chance to fix their systems.

A developer named J4ck3LSyN posted the code in a GitHub project called php2shell-poc. A proof of concept is test code that shows a flaw is real. According to reports, the developer said they rebuilt and tested both flaws. The developer also said one bug reached a lab-ready attack stage. That means the attack worked in a controlled test setting.

Still, these claims need careful reading. Reports say the developer updated the project after admitting the first attack chain did not work. Published code alone does not prove every attack works on real servers. Real servers are the live machines that visitors use every day.

A second attack came from a security firm named Calif. Reports say a short video showed it running commands on a WordPress test site. The video stayed online only for a brief time. This attack is separate from the GitHub project. The reports do not say whether both attacks use the same method.

Public coverage calls the leaked flaws PHP2Shell. According to reports, they could allow remote code execution without a login. In simple words, an attacker could run commands on another computer without signing in first. Think of a stranger walking into a house without knocking. That stranger could see private data. The attacker could also take control of affected services.

PHP Confirms Two Critical Flaws

The PHP team planned its security release for 14:00 UTC on October 21. It had warned users about the release the day before. Both flaws carry a CVSS score of 9.2. A CVSS score rates how serious a flaw is. This score puts both flaws in the critical group.

Each flaw also has a public tracking number, called a CVE ID. They are CVE-2026-109618 and CVE-2026-109619. PHP’s official advisory later explained each one. The first flaw involves memory corruption when a program runs out of memory. Memory is the space a program uses to hold data while it works. Corruption means that data gets damaged.

The second flaw involves old internal data that stays behind after memory is freed. In plain words, the program clears its space but leaves traces of the old information. Under the right conditions, both flaws can lead to remote code execution.

Security groups reacted before the fixes arrived. CERT-EU told organisations to find the PHP installations they use. It also told them to prepare to apply the updates right away. Reports say researchers at watchTowr reproduced one of the flaws. They kept the technical details private until the official release.

The public code raised the pressure on defenders. Even a weak first attempt can still help others. According to reports, more testing and changes can help researchers or attackers build a working method. The analysis notes in the project add more detail on the claims.

Fixed Versions are Out, and Older Ones Need Vendor Help

PHP released the security updates on October 21. Both flaws are now fixed in the new versions. These are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The team urged users to update immediately.

The team also warned about systems that serve web requests. These setups could be exposed. They include PHP-FPM, Apache setups that use mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Some sites still run older PHP branches. PHP 8.1 and earlier no longer get regular updates from the PHP project. Owners of those sites should ask their hosting provider or operating system vendor about fixes. Some vendors may offer backported patches. A backported patch is a fix that a vendor adapts for an older version.

The advisory is clear on one point. Changing settings does not replace the security updates. Administrators should first confirm which PHP version their websites really run. Next, they should apply the right fix from their vendor. They should also review server logs for strange activity.

This case shows the risk of leaked details and publicly available attack code. Sometimes the code appears before organisations finish their patching work. Both flaws now have fixes in the latest releases. Website operators should focus on updating their systems. They should not rely on unproven attack claims or short-term workarounds.