PHP Under Attack: The Critical Vulnerabilities Every Web Developer Should Know About in 2026

Two critical PHP vulnerabilities have put web servers at risk of remote code execution. Here's what happened, why it matters, and what developers should do next.

Imagine you are running a website that handles user accounts, payments, or sensitive customer information. Your application is working perfectly. Your authentication system is secure, your database queries use prepared statements, and your application passes security tests.

But there is a problem: the programming language running your application has a vulnerability that an attacker may exploit before your application code even executes.

This is not just a theoretical security concern. On October 21, 2026, the PHP development team released security updates addressing two critical vulnerabilities that could allow unauthenticated attackers to execute malicious code remotely on vulnerable servers.

The vulnerabilities, tracked as CVE-2026–109618 and CVE-2026–109619, have been described in security advisories as the php2shell vulnerabilities. Security agencies have urged organizations to patch affected installations immediately. Source: PHP security advisory

For developers, security engineers, and anyone responsible for a web application, this incident highlights an important lesson: application security does not stop at the code we write.

1. What Happened? Understanding the PHP Vulnerabilities

PHP is a widely used server-side programming language. It powers content management systems, e-commerce platforms, APIs, and countless other web applications.

When a browser sends a request to a PHP application, the server processes that request and returns a response. Before your application can handle the request, however, the PHP runtime itself must perform internal operations, such as parsing input and managing memory.

The recent vulnerabilities demonstrate how weaknesses in these low-level operations can have serious consequences.

According to the PHP security team, the two vulnerabilities can enable remote code execution without requiring authentication.

Let's understand the underlying concepts.

CVE-2026–109618: Memory corruption during error handling

Modern applications have limits on how much memory they can use. PHP, for example, supports a configurable memory_limit.

Consider this simplified configuration:

memory_limit = 128M

memory_limit = 128M

This setting limits the memory available to a PHP script to approximately 128 megabytes.

What happens when a request exceeds that limit?

PHP must interrupt the operation and clean up resources. However, if an error interrupts an internal operation while its data structures are only partially initialized, incorrect cleanup can lead to memory corruption.

Memory corruption means that a program accesses or modifies memory in an unexpected or invalid way. Depending on the circumstances, attackers may exploit such behavior to change how a program operates.

In this case, the vulnerability involves memory corruption during out-of-memory handling. Under certain conditions, it can lead to remote code execution.

CVE-2026–109619: Stale internal state

The second vulnerability involves internal state that can remain accessible after the memory backing it has been freed.

This is related to a class of programming errors commonly known as use-after-free.

Imagine a program allocates memory for an object and later releases that memory. If the program subsequently uses a reference to the released memory, it may read invalid data or interact with memory that has been reused for another purpose.

Under certain conditions, such behavior can compromise program execution.

The important point is that these are vulnerabilities in the PHP runtime itself, rather than simply mistakes in an individual website's business logic.

Both vulnerabilities have been associated with a critical severity rating and can potentially allow unauthenticated remote code execution. Source: CERT-EU security advisory

2. Why Is Remote Code Execution So Dangerous?

Remote code execution, commonly abbreviated as RCE, occurs when an attacker can cause a vulnerable system to execute code of the attacker's choosing from a remote location.

The impact depends on the vulnerability, the server's configuration, and the privileges available to the affected process.

Potential consequences include:

Data exposure: Access to sensitive information available to the compromised service.
Application compromise: Unauthorized changes to application files or behavior.
Credential theft: Exposure of secrets, database credentials, or API keys accessible to the service.
Persistence: Attempts to establish continued unauthorized access.
Lateral movement: Attempts to reach other systems through the compromised server.
Service disruption: Interference with application availability or normal operations.

Consider an online store built with PHP. If an attacker compromises its web server, the attacker may attempt to access customer records, payment-related data, or internal services, depending on the permissions and architecture.

This does not mean every vulnerable server will suffer all these consequences. It means that the potential impact is serious enough to demand urgent attention.

Another important detail is that authentication at the application level may not be sufficient protection against a vulnerability that can be triggered before application code runs.

That is why organizations must assess vulnerabilities in their complete technology stack, not just their login systems and application endpoints.

3. Which PHP Installations Are Affected?

The October 21 security release addressed the vulnerabilities in the following PHP branches:

PHP branchFixed releasePHP 8.58.5.12PHP 8.48.4.27PHP 8.38.3.36PHP 8.28.2.35

Installations running earlier versions in these branches should be assessed and updated. PHP 8.1 and older branches no longer receive updates from the PHP project, although some operating-system vendors may provide backported security fixes.

The issue is not limited to one web server configuration. PHP installations serving web requests can be affected across several deployment models, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Organizations should also consider PHP bundled inside third-party products, appliances, containers, and management interfaces.

For authoritative version information, consult the official PHP website.

4. How Should Developers and Security Teams Respond?

Discovering a critical vulnerability is only the first step. The next challenge is reducing risk without unnecessarily disrupting business operations.

A practical response involves the following steps.

Step 1: Identify every PHP installation

Start by building an inventory of systems that run PHP.

Do not limit the search to websites that your team directly develops. PHP may also be included in:

Content management systems.
E-commerce platforms.
Internal administrative portals.
Docker images and application containers.
Third-party applications and appliances.
Legacy applications maintained by other teams.

On a server where the PHP command-line executable is available, run:

php -v

php -v

This displays the CLI PHP version.

Important: The CLI version may differ from the version used by the web server. Check the actual runtime serving requests, including PHP-FPM pools, Apache modules, container images, and vendor-managed installations.

Step 2: Prioritize exposed systems

Not every vulnerable system presents the same level of risk.

Start with systems that are accessible from the public internet, particularly those handling sensitive information or supporting critical business functions.

Consider these factors when prioritizing remediation:

Internet exposure.
The vulnerable PHP version and runtime configuration.
Business criticality.
Access to sensitive data and internal systems.
Availability of a fixed package.
Evidence of attempted or successful exploitation.

A production application supporting financial transactions should receive particular attention because compromise could affect confidentiality, integrity, and availability.

Step 3: Apply the security updates

Upgrade to the appropriate fixed PHP release or apply a verified vendor-provided backport.

For containerized deployments, update the base image or runtime package and rebuild and redeploy the affected containers.

For managed hosting or third-party appliances, confirm the vendor's remediation status instead of assuming the underlying PHP runtime has been updated.

In a production environment, coordinate the deployment with the responsible application, infrastructure, and security teams.

A maintenance window and testing may be appropriate, but they should not become reasons for indefinite delay. If immediate remediation is impossible, follow the vendor and security-agency guidance on isolation or taking affected systems offline.

A web application firewall may offer an additional defensive layer, but it is not a substitute for a security update.

Step 4: Verify that the fix is effective

After patching, confirm the PHP version actually running in production.

Then verify:

The web server and PHP workers have loaded the updated runtime.
All relevant application instances and containers are updated.
Health checks and application functionality work as expected.
Monitoring and logging remain operational.
No unpatched replicas or forgotten servers remain exposed.

A successful package installation is not enough if the vulnerable runtime continues serving requests elsewhere in the environment.

Step 5: Investigate possible compromise

Patching addresses the vulnerability, but it does not automatically remove an attacker's existing access.

Review web server, application, authentication, and endpoint logs for suspicious activity.

Look for unusual behavior, such as:

PHP worker processes launching unexpected shell commands.
Unexpected files or executable scripts appearing on the server.
Unusual outbound network connections.
New accounts, scheduled tasks, or persistence mechanisms.
Unexpected changes to application files.
Abnormal access to sensitive resources.

Correlate events across multiple data sources instead of relying on a single suspicious log entry.

If compromise is suspected, preserve relevant evidence, isolate affected systems where appropriate, and follow your organization's incident response process.

Security teams should also rotate exposed credentials and investigate related systems when the evidence indicates that secrets or connected infrastructure may have been compromised.

5. What Can Web Developers Learn From This Incident?

Although this incident concerns the PHP runtime, its lessons apply to developers using any programming language.

Keep dependencies and runtimes updated

A web application depends on more than its own source code.

Its security also depends on the language runtime, operating system, web server, libraries, database drivers, and third-party packages.

Maintain an inventory of these components and establish a process for tracking security advisories.

For PHP applications, Composer can help manage application dependencies, while tools such as software composition analysis scanners can identify known vulnerabilities in supported dependency ecosystems.

Remember that updating Composer packages alone does not necessarily update the PHP runtime.

Apply the principle of least privilege

A web server should have only the permissions required to perform its job.

For example, an application that only needs to read certain configuration files should not have unrestricted access to every directory on the server.

Similarly, separate application services where practical and restrict their access to databases, internal APIs, and administrative interfaces.

Least privilege cannot eliminate a runtime vulnerability, but it can limit the damage an attacker may cause after a successful compromise.

Separate application security from infrastructure security

Developers often focus on familiar vulnerabilities such as SQL injection, cross-site scripting, and broken access control.

These remain important, but they are only part of the security picture.

A secure application also needs:

A supported and patched runtime.
Secure server configuration.
Restricted network access.
Protected credentials and secrets.
Centralized logging and monitoring.
A tested backup and recovery strategy.
A defined vulnerability management process.

Security must be addressed across the entire software lifecycle.

Prepare before a critical vulnerability appears

Organizations should not begin creating their patching process after a critical vulnerability is announced.

Maintain an asset inventory, define emergency change procedures, test deployment and rollback processes, and establish clear responsibilities for security updates.

The ability to identify affected systems quickly can be just as important as the ability to install a patch.

6. A Note for Cybersecurity Students and Aspiring Security Engineers

This incident is also a useful learning opportunity for anyone entering application security or security operations.

Instead of simply memorizing a CVE number, try to understand the complete vulnerability management process.

Ask yourself:

How would I identify every affected PHP installation in an organization?
How would I determine which systems are exposed to the internet?
How would I prioritize remediation if several critical systems were affected?
How would I verify that a patch was deployed correctly?
Which logs would help me investigate possible exploitation?
How would I communicate the risk to a non-technical manager?

These questions connect technical knowledge with the practical responsibilities of a security engineer.

You can also study the relevant vulnerability classifications, memory-management concepts, and incident response techniques in a controlled lab environment. Any testing should be performed only on systems you own or are explicitly authorized to assess.

The goal is not merely to recognize a vulnerability. It is to understand how to reduce risk, verify remediation, and protect business operations.

Conclusion: Security Is More Than Writing Secure Code

The recent PHP vulnerabilities demonstrate an uncomfortable reality: even an application that follows good coding practices can inherit serious risks from the software components beneath it.

Secure authentication, parameterized database queries, input validation, and careful access-control design are essential. But they cannot replace timely runtime updates, secure infrastructure, continuous monitoring, and effective incident response.

For developers, the lesson is to think beyond the application code.

For system administrators, it is to maintain visibility into every deployed runtime.

For security teams, it is to turn vulnerability intelligence into prioritized, verified action.

A vulnerability becomes a business risk when an organization cannot identify it, assess it, or respond to it effectively.

The strongest security posture is not one in which vulnerabilities never appear. It is one in which they are discovered quickly, addressed responsibly, and prevented from becoming larger incidents.

Stay curious. Keep learning. And remember: secure software is not a one-time achievement; it is an ongoing process.

References and further reading

Disclaimer: This article is intended for educational and defensive cybersecurity purposes. Consult official vendor advisories for the latest technical details and remediation instructions.

Contents