PHP has patched two remote code execution vulnerabilities rated 9.2 on CVSS v4.0 that affect nearly every installation serving web requests. Turkiye's Cyber Security Directorate has issued a national advisory.
On 21 October 2026 the PHP development team shipped patches for two critical vulnerabilities that affect virtually every PHP installation serving web requests. Researchers named the pair php2shell: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale according to SOCRadar. Either one allows remote code execution on the server from a single unauthenticated request, before any application code runs.
What is actually affected
The weakness is not in a particular application but in PHP's request lifecycle. One flaw lets out-of-memory handling interrupt PHP while request data is only partially initialised, after which cleanup treats that data as valid (CVE-2026-109618). The other lets request-owned internal state survive after its memory has been freed, so a later request on the same worker can reach it (CVE-2026-109619). That puts PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed all in scope, with mod_php setups carrying the highest risk according to Help Net Security.
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4, 8.0 and 8.1 received source backports only, and nothing was issued for 7.3 or earlier. Several Linux distributions and long-term support vendors have shipped their own patches.
Why this one cannot wait
Three details separate this from a routine patch round. Exploitation attempts began before the fix existed: Amazon's threat intelligence team logged an attempt against a honeypot on 17 October, four days ahead of disclosure. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 26 October and set 29 October as the remediation deadline for federal agencies. And the vendor picture is still moving, with Palo Alto Networks confirming that all PAN-OS versions are affected.
The counterweight matters too. No wave of confirmed breaches has been reported in the first ten days. SOCRadar found that the sites it screened did not meet the exploit's preconditions, and Unit 42 withdrew a report that had linked an intrusion at a European government agency to php2shell. Most observed traffic is scanning and fingerprinting. The right response is a fast, planned patch cycle rather than alarm.
What it means for businesses in Türkiye
Türkiye's Cyber Security Directorate published national advisory TR-26-1372 on 21 October 2026, asking public bodies, critical infrastructure operators and private companies to review their systems, and announcing nationwide scanning.
For small and mid-sized companies the real exposure sits in the PHP installations nobody owns: an old corporate site parked on shared hosting, an internal stock or quoting tool that has run untouched for years, a forgotten admin panel left open to the internet, a device whose web interface happens to be PHP. These usually fall outside the maintenance plan and nobody knows which version they run. Shodan data cited by SOCRadar counts roughly 884,000 internet-facing hosts still running PHP 8.1 or older.
What Kamer Bilişim recommends
- Inventory first, then patch. Write down every server, hosting account and device where PHP runs. Anything on an unsupported branch (7.x, 8.0 or 8.1) goes to the top of the list, because it needs a version upgrade rather than a patch.
- Close management interfaces to the outside. As the Cyber Security Directorate advises, use firewall rules and access lists to restrict admin panels to known IP addresses, and cut inbound international traffic to systems that have no reason to receive it.
- Test a restore, not just the backup. Remote code execution incidents end in data theft and ransomware often enough that backups become the whole plan. Run a real restore on at least one server and measure how many hours it takes.
If you would like help with a server inventory, your hosting environment or your firewall rules, reach us through our contact page. We work on site across the Anatolian side of Istanbul and remotely elsewhere.
Source: SOCRadar, Help Net Security, Republic of Türkiye Cyber Security Directorate (TR-26-1372)
Source: SOCRadar