# PHP’s October 2026 RCE fixes: what application teams should verify > PHP released fixes for two critical remote-code-execution vulnerabilities on 21 October 2026. Here is what the primary PHP sources confirm, how to handle the follow-up session configuration warning, and how to verify a rollout securely without running exploit traffic. Official source: https://warhoundai.com/blog/php2shell-october-2026-patching-guide/ Published: 2026-10-25 Author: WarHoundAI Updated: 2026-11-12 ## What happened, and what is confirmed On 21 October 2026, the PHP project published security releases addressing CVE-2026-109618 and CVE-2026-109619. Its advisory explicitly states that the vulnerabilities can permit unauthenticated remote code execution in PHP installations serving web requests. The project warned that configurations using mod_php face the highest risk, as demonstrated attacks can occur during initialization before application code even executes. Earlier drafts of this analysis cited a separate CISA alert that reportedly dubbed the vulnerability pair 'php2shell' and made claims about in-the-wild exploitation. Because that external source is currently unavailable and returning HTTP errors, those claims cannot be corroborated. In accordance with strict evidence limits, we have removed references to the unverified CISA statements and are relying exclusively on the confirmed PHP project advisories retrieved on 12 November 2026. - [PHP’s 2026 news archive and advisories](https://www.php.net/archive/2026.php) ## The boundary is the runtime, not just application code PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed among the affected web-serving configurations. Because the exploit can trigger during runtime initialization, a login check or request validator inside an application cannot be assumed to protect the deployment. For CVE-2026-109618, PHP describes an out-of-memory (OOM) handling issue that interrupts partially initialized internal request data; subsequent cleanup routines can then treat invalid data as valid. For CVE-2026-109619, request-owned state can outlive the memory backing it, leading to stale global state being reused by a later request in the same worker process. These are profound memory and request-lifecycle flaws, requiring systemic runtime updates rather than application-layer input sanitization. ## Which releases contain the October 21 fixes? PHP identifies specific upstream releases as fixing the two October 21 vulnerabilities. Application engineering teams must ensure they deploy a supported release containing the applicable security fixes, or obtain explicit confirmation from their operating-system vendor if relying on backported patches. The fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer receive regular updates from the PHP project. While PHP provided minimal source backports for older branches in this exceptional case, treating an emergency backport as a long-term strategy is dangerous. Teams should prioritize migrating to a fully supported version. ## Do not miss the separate October 23 session warning Following the initial patch, PHP issued a 23 October informational advisory describing an additional, unusual session-upload-progress configuration. The stated prerequisites include configuring session.serialize_handler as php_binary or php_serialize, explicitly changing it to php at runtime before calling session_start(), and leaving session upload progress enabled. The project suggests setting session.upload_progress.enabled=0 until the next regular bugfix release to fully protect against this unlikely vector. Applications that never change the serialization handler at runtime can technically keep the feature enabled, but defense-in-depth favors disabling unused capabilities. Test any configuration change against the application’s actual upload behavior. ## Safe test matrix and expected outcomes To verify that mitigations and patches are correctly applied without exposing the infrastructure to actual exploit payloads, engineering teams should rely on a safe synthetic test matrix. These synthetic fixtures generate standard operational load to confirm that limits are enforced and processes recycle cleanly. Execute these checks from an authenticated administrative environment against a staging replica that mirrors production exactly. - Test Case 1: Standard multipart upload strictly under post_max_size limits. Expected outcome: HTTP 200 OK, application parses payload normally, verifying that general file uploads are not broken by overly aggressive WAF or proxy limits. - Test Case 2: Multipart upload deliberately exceeding the newly constrained post_max_size (e.g., sending 40MB when the limit is 32MB). Expected outcome: HTTP 413 Payload Too Large or standard application rejection, with no segfaults or unexpected worker child processes in the logs. - Test Case 3: OOM simulation via container memory cgroup limit exhaustion (safe boundary test). Expected outcome: The isolated worker is killed by the OOM killer, returning an HTTP 502/503. The runtime must not leak partially initialized state to subsequent requests. ## Implementation tradeoffs and failure modes When an immediate update is impossible, applying temporary configuration mitigations introduces severe implementation tradeoffs. PHP’s advisory notes that setting memory_limit=-1 removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path. This forces the memory management down to the OS or container level. A critical failure mode of this mitigation is that a rogue request can consume all available host memory if container boundaries are not strictly enforced, leading to cascading system failure. Using a container or cgroup limit acts as a hard availability boundary, but teams must ensure the policy only kills the affected worker. Temporary controls never substitute for a binary patch. ## Sources, date, and editorial limits Previously drafted claims attributed to CISA regarding the 'php2shell' moniker and active exploitation were removed because the source URL returned an HTTPError during verification, rendering it inadmissible as evidence under our editorial guidelines. Drafted with Gemini and checked for source links, advisory identifiers, structure and unsupported product claims. Examples are synthetic and are not scan results. Drafted with Gemini and checked for source links, advisory identifiers, structure and unsupported product claims. Examples are synthetic and are not scan results. - [PHP: 2026 news archive and security advisories](https://www.php.net/archive/2026.php)