Critical RCEs in PHP: update immediately 🚨
Two critical RCE vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow code execution before application startup, alongside OpenAI’s php2shell-checker skill.
Emergency PHP updates have just shipped after two critical vulnerabilities were discovered at once. The risk is highest for mod_php: an attacker can compromise a server with a regular HTTP request before your application code even begins executing.
What do these flaws allow attackers to do?
- Memory cleanup failure (CVE-2026-109618): An attacker can deliberately trigger an out-of-memory (OOM) error during request initialization. Because of a bug, the cleanup handler treats corrupted data as valid, leading to arbitrary code execution with web server privileges.
- Worker hijacking (CVE-2026-109619): An attacker can “poison” internal process state that is not cleared after memory is freed. The next request routed to the same worker picks up the stale state before initialization, giving the attacker control over execution.
How to protect your servers?
- Update: Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (minimal patches were even released for legacy 7.4, 8.0, and 8.1 branches).
- Temporary mitigation: Set
memory_limit=-1, cappost_max_size(8M/32M), disablesession.upload_progress.enabled=0, and on PHP 8.5 setfatal_error_backtraces=0, then restart all workers.
Given that roughly 70% of the web runs on PHP, it is hard to see how site owners are going to patch this hole. Most will probably do nothing at all—the only real hope is that hosting providers quietly update their infrastructure themselves.
Update: php2shell-checker skill from OpenAI
Following up on the critical PHP vulnerabilities, OpenAI released an official skill for its agents called php2shell-checker.
It could not be simpler to use: give the AI your site’s URL, and the skill scans the server for these new RCEs, checks the configuration, and immediately suggests a fix if it finds a vulnerability.