CVE-2026-109618
Memory corruption during request handling
A specially formed web request can push PHP into an out-of-memory condition at a dangerous moment. During cleanup, PHP may then treat incomplete or corrupted request data as valid.
Critical PHP security update
Is your PHP website exposed to PHP2Shell?
Two newly disclosed PHP vulnerabilities can allow an unauthenticated attacker to run code on an affected web server. We can check your website, safely update PHP and verify it still works—from £199*.
* Excludes VAT (where applicable). UK-based help Safe upgrade & testing No fix, no fee
VULNERABILITYPHP2Shell
- CVE-2026-109618Critical
- CVE-2026-109619Critical
- Patched releaseAvailable
CVSS 9.2 / 10Unauthenticated remote code execution
Do not wait for visible symptoms.A vulnerable site can appear completely normal. The reliable fix is to install a patched PHP release and verify the application afterwards.Request a check →
What was discovered?
Two flaws in the engine behind millions of websites.
On 21 October 2026, the PHP project released emergency fixes for two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 out of 10 and can lead to remote code execution.
CVE-2026-109619
Stale data reused by a worker
Internal state from one failed request can survive after its memory has been released. A later request handled by the same PHP worker may use that stale state, creating a use-after-free condition.
The vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP. Updating to a fixed vendor release is the only complete mitigation.
The worst-case scenario
An attacker gains control without logging in.
Successful exploitation can allow code to run with the permissions of your website’s PHP worker. What happens next depends on the server, hosting controls and what that account can reach.
Help me secure my site →Are you affected?
Compare your PHP version.
If your host provides a backported security fix, the visible version number alone may not tell the whole story. We verify the actual vendor package and web runtime—not just the control-panel label.
Running PHP 8.1 or older?Upstream support has ended. Some vendors may provide a backported fix, but moving to a supported PHP branch should be planned and compatibility-tested.
Our one-off repair
Patch first. Prove it works afterwards.
Updating PHP without checking the application can trade a security risk for a broken website. Our service includes the preparation and testing needed for a safer change.
Confirm exposure
Identify the PHP runtime, hosting platform, vendor package and the safest supported target version.
Prepare and protect
Check backups and recovery options before changing the live environment.
Patch PHP
Apply the appropriate fixed release using your host or server’s supported update route.
Test and verify
Check the public site, key forms, administration area and actual web-serving PHP version.
Our promise
From £199one-off** Excludes VAT (where applicable).No fix, no fee.
If we cannot complete the agreed PHP security update and confirm the website is working after our checks, you will not pay our labour charge.
Request a PHP2Shell check
Let’s get your website onto a safe release.
Tell us where the site is hosted and anything you know about its PHP version. We will review the details and contact you about the safest next step.
- One-off security patch from £199* excludes VAT (where applicable)
- Compatibility-aware upgrade
- Post-update website checks
- No fix, no fee promise
Website security enquiry
Check my website
Fields marked with an asterisk are required.
*Pricing and promise: £199 excludes VAT (where applicable) and is the starting price for one standard website on a supported hosting platform. We will confirm scope and price before work begins. Complex migrations, application-code remediation, malware removal, paid licences, hosting charges and third-party costs are excluded unless quoted. “No fix, no fee” applies to our agreed PHP patching labour where we cannot complete the update and post-update checks; it does not cover pre-existing faults or unrelated work.
This page provides general security information, not confirmation that a particular website is vulnerable or compromised. A technical check is required.