PHP CVE-2026-109618: Urgent Patch Night as Panels Scramble

PHP shipped emergency releases tonight for two critical flaws nicknamed php2shell. If you self-host WordPress, a blog, an AI front-end or any other PHP app on a VPS panel, PHP CVE-2026-109618 and CVE-2026-109619 are the ones you need to patch before you sleep. Both are scored CVSS v4.0 9.2 by the PHP security team — not 10.0, despite that number floating around earlier today. There is no complete configuration workaround. Updating PHP is the only safe choice.

This piece walks through what happened tonight in Beijing time (UTC+8), what the advisories actually say, how panels like RunCloud and Prostack scrambled, and how to check your own box. Times below are Beijing time unless noted; UTC is shown where it helps.

What happened tonight

On 20 October, details of the two flaws leaked on social media and Hacker News before the planned 22 October disclosure. The PHP Foundation’s X account pre-announced a critical release for 14:00 UTC (22:00 Beijing) on 21 October, both bugs rated CVSS v4.0 9.2. Hosts and WAF vendors started moving hours earlier.

At 11:02 Beijing (03:02 UTC), Cloudflare turned on default WAF rules for all plans, including Free — about nine hours before public disclosure. At 15:43, Cloudflare CTO Dane Knecht wrote on X that sites behind Cloudflare already had rules for known exploit vectors, that “we are seeing early attacks emerging”, and that this was a STOPGAP only (post).

Around 16:00, RunCloud disabled session.upload_progress on every server and posted a community notice at 16:58 (08:58 UTC). As of 23:00 tonight that community page returns a bare “We are in maintenance mode due to PHP Update” message; the text below of RunCloud’s notice comes from a search-engine cache of the page, which is currently unavailable and has no Wayback Machine copy.

Customers of managed panels also received in-product or email notices tonight. If you use RunCloud, check the dashboard and any mail from the provider for your stack’s patch status — do not wait for the community site to come back.

Around 21:35–21:40, php.net published 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — ahead of the 22:00 slot. Prostack later stamped an update (15:30 UK time, about 22:30 Beijing) that every Cito server was patched. Hosting panels spent the evening in maintenance; that is why some dashboards looked broken tonight.

What the two CVEs are

Both bugs sit in PHP itself. Updating WordPress, a theme or a plugin does nothing. Per the php.net security advisory and the GitHub advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp:

• CVE-2026-109618 — RCE via OOM corruption. When PHP runs out of memory while setting up a request, it can leave half-initialised data. Cleanup then treats that data as valid. Confirmed triggers include crafted multipart uploads that stay inside normal PHP limits. Highest risk on Apache mod_php; FPM is still treated as susceptible.
• CVE-2026-109619 — RCE via stale global state. Request-owned state can survive after its memory is freed. A later request on the same worker can use it. Confirmed consumers include session upload progress (on by default; no session_start() needed) and, on PHP 8.5, fatal-error backtraces.

Impact, per the advisories: unauthenticated remote code execution as the web worker. NVD has received both records (CVE-2026-109618); as of this writing its analysis status is still “Received”. As of 01:15 Beijing time on 22 October, neither CVE is in KEV — the latest CISA catalog is still the version dated 21 October 14:04 UTC (KEV catalog).

Affected and fixed versions

Stay on your current major.minor branch and take the fixed patch for that branch. Jumping straight to 8.5 is not required and often breaks older apps. If you install PHP from a distro package, check the vendor advisory for the package version — Ubuntu and similar often keep the upstream version string while changing the package revision.

Branch	Affected	Fixed release	Official support
8.5	< 8.5.12	8.5.12	until 31 Dec 2029
8.4	< 8.4.27	8.4.27	until 31 Dec 2028
8.3	< 8.3.36	8.3.36	until 31 Dec 2027
8.2	< 8.2.35	8.2.35	until 31 Dec 2026
8.1 / 8.0 / 7.4	affected	no official release; minimal source backports only	EOL
7.3 and older / 5.x	treated as affected by researchers & CERT-FR	vendor backports only, if any	EOL

Sources: GHSA, php.net. The NVD structured data lists 8.2–8.5; the “from PHP 5.4 onward” wording comes from researchers and CERT-FR, not from the CNA’s structured product list.

AI found a bug that hits most of the web

This is the part that matters for an AI-heavy audience. Per OpenAI’s “Patch the Planet” post and the @OpenAI post at 22:04 Beijing, OpenAI models helped researchers — through that initiative — find critical flaws in PHP. Partner Calif used GPT-5.6 Sol; Wiz independently found and reported both vulnerabilities. OpenAI says it spent about two months coordinating maintainers, researchers and providers (including Cloudflare and Wiz) because the engine change was intricate. It also says the coalition engaged U.S. government partners including the White House’s Super Intelligence Force, ONCD and CISA, plus international partners.

OpenAI president Greg Brockman followed at 22:58 Beijing with an X Article, “Towards securing the internet” (post), calling php2shell one of the most severe open-source bugs in recent memory and noting the original target date was 22 October before the leak forced an early release. To put the blast radius in plain numbers: W3Techs (21 October 2026) says PHP is used by 69.3% of websites whose server-side language is known — roughly three quarters of that measurable set. Of sites that use PHP, about 35% still run PHP 7 or 5 (27.0% + 7.7%), versions with no official fix tonight.

One quiet fact that fits the “OpenAI notified the White House” thread: the public White House site at whitehouse.gov is a WordPress site (its homepage HTML contains well over 200 wp-content references) and its edge headers match WordPress VIP. Automattic handles patching there. We are not claiming it was vulnerable or patched tonight — only that even that site runs on WordPress/PHP under a managed host.

Government warnings, including Japan

At 20:55:59 Beijing, the Japanese Prime Minister’s official X account @takaichi_sanae posted an urgent request: check whether public websites use PHP, prepare to apply tonight’s patch at 23:00 Japan time, and consider taking a site offline temporarily if a fast patch is hard. The account bio notes that some posts during the term are made by publicity staff, so this article treats it as an official-account post, not a claim about who typed it. Metrics when we last read the post via the X API (about 23:05 Beijing): roughly 20.7M views, 52.4K reposts, 170.7K likes.

The wording closely tracks two posts from Japan’s National Cybersecurity Office account @cyber_forecast — one at 12:01 asking owners to prepare for the 23:00 Japan-time patch, and one at 20:44 saying temporary shutdown is a valid risk reduction. A head of government’s official channel amplifying a same-day cyber alert is unusual enough to note; the technical content itself is the NCO’s.

What each platform did

Closing session.upload_progress only blocks one confirmed path of CVE-2026-109619. It does nothing for CVE-2026-109618. PHP’s advisory is explicit: no complete mitigations.

Platform	Mitigation tonight	Who gets a patch	Old branches
RunCloud	Disabled session.upload_progress; optional NGINX multipart templates	Auto for 8.2+ once builds land (Native / Docker / LSAPI pending at last cache)	No patched builds for 8.1 and older — switch apps to 8.2+
Prostack	Kept upload_progress off; patches rolling	Cito: all servers patched; backports 5.6–8.4	cPanel path: backports from 7.4 up; below 7.4 must upgrade
cPanel	EasyApache 4 25.91	ea-php74 through ea-php85	Back to 7.4
Plesk Linux	PHP packages for 8.2–8.5	8.2.35 / 8.3.36 / 8.4.27 / 8.5.12	7.4–8.1 and Windows: still in development
Laravel	Cloud & Vapor auto; Forge manual	PHP 8 apps	Power down if you cannot update (per Laravel’s notice)
Cloudflare (WAF)	Default managed rules + full-transaction detection	All plans including Free	Stopgap — still patch PHP

Distro notes as of tonight: Debian published DSA-6574-1 for php8.4 on Trixie. Ubuntu’s tracker lists the CVEs as Critical; do not confuse them with USN-8936-1 (19 October), which is a different bug. Red Hat is tracking the issue in Bugzilla 2556842; a formal RHSA was not verified here by press time. Remi’s repo was stated by PHP not to update today.

How to check and patch your own server

1. See what you actually run: php -v and a short-lived phpinfo() page (CLI and FPM often differ). Target ≥ 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 on your branch.
2. Check upload progress: php -i | grep session.upload_progress.enabled, then confirm in the web SAPI. Set session.upload_progress.enabled = Off in php.ini or php_admin_flag[session.upload_progress.enabled] = off in the FPM pool. Restart workers. ini_set() and .user.ini are too late.
3. On PHP 8.5 only, also set fatal_error_backtraces=0 until you patch.
4. Update: apt update && apt upgrade, dnf upgrade 'php*', EasyApache / Plesk UI, or your panel’s PHP rebuild. Then restart Apache (mod_php), PHP-FPM and any long-lived workers (Octane, queues).
5. WordPress: media uploads, plugin/theme installs and many forms use multipart. Do not blanket-block multipart on a live WP site unless you have carefully allow-listed paths.
6. If you are stuck on 8.1 or older with no vendor backport, migrate tonight or take the site offline until you can — the advice echoed by Japan’s NCO and by several hosts.

# examples — adjust package names for your OS
php -v
php -i | grep session.upload_progress.enabled
# Debian/Ubuntu packages (after vendor publishes):
sudo apt update && sudo apt upgrade
sudo systemctl restart php8.2-fpm   # or your version
# confirm no old workers:
ps aux | grep php-fpm

OpenAI’s official checker — and what UNKNOWN really means

At 00:35 Beijing time on 22 October, OpenAI released an official PHP2Shell self-check tool. It sends no attack requests. It only reads the PHP version your site already exposes in its HTTP response headers (X-Powered-By and Server), or, with --local, what php -v reports on the machine you run it on. It needs Node.js and nothing else to install.

GitHubopenai/php2shell-checkerJavaScript39 stars1 forksUpdated 2026-10-21View on GitHub ↗

Point it at a site with node phpcheck.js "https://example.com", or run node phpcheck.js --local on the server itself. You get one of three answers: OK, VULNERABLE or UNKNOWN.

The catch: most shared hosts and panels hide the PHP version header, so on plenty of sites the tool will simply say UNKNOWN. That does not mean you are safe — the README says so too. Log into your panel or run php -v, and upgrade within your branch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. And even an OK is only a version-number comparison, not proof the fix is actually in.

Managed panel vs self-managed

Tonight is a clean A/B test. On a managed panel that auto-builds PHP, you mostly watch dashboards and avoid overriding session.upload_progress in a stray .user.ini. On a self-built VPS you are the release engineer: inventory every PHP binary (CLI, FPM, containers, odd chroots), apply the vendor package, restart workers, and prove the running version. The AI angle is not that “AI makes hosting easy”; it is that AI found a fourteen-year-class bug in the language under your stack, and the people who sleep better tonight are the ones whose host already had a patch pipeline.

Exploitation status — what we can say

• Status as of 01:15 Beijing time, 22 October. Public proof-of-concept code is now out: several PoC repositories for CVE-2026-109618/109619 are public on GitHub and being passed around on X. We have not tested them and are not linking them.
• Security vendors are seeing attackers try that public code. Vega Threat Research said at 23:01 Beijing on 21 October that it is seeing exploit attempts in the wild using the public PoC. watchTowr told SecurityWeek that its first in-the-wild attempts hit its sensors around the time the patches landed, and that none had succeeded so far. Cloudflare also reports attack traffic and mutating payloads (blog, Knecht).
• Still no confirmed compromise: these are scanning and exploitation attempts. We have not found any confirmed report of a site actually being broken into through these bugs.
• Still not in CISA KEV as of 01:15 Beijing time (latest catalog dated 21 October 14:04 UTC, KEV catalog).

FAQ

Is closing session.upload_progress enough?

No. It only blocks one confirmed path of CVE-2026-109619. It does nothing for CVE-2026-109618. PHP says there are no complete mitigations.

Does Cloudflare protect me?

If traffic is proxied through Cloudflare and the Managed Ruleset is in block mode, you get a default stopgap from 11:02 Beijing today. You still need to patch PHP. Rules alone are not a fix.

I am on PHP 8.1. Am I fine?

Not from php.net. Only hosts that backport (for example Prostack on Cito back to 5.6, or cPanel from 7.4) cover you. Otherwise move to 8.2+ or stay offline until you can.

Will updating WordPress plugins help?

No. The bugs are in the PHP runtime. Plugin updates do not replace a PHP upgrade.

Why do some posts say CVSS 10.0?

Early secondary write-ups used 10.0. The PHP security team, GHSA and NVD records use CVSS v4.0 9.2 with attack complexity High and attack requirements Present.

Was OpenAI itself breached?

No evidence of that. OpenAI’s public role here is discoverer and coordinator via Patch the Planet, not an affected SaaS customer narrative.

Sources

• php.net security advisory · GHSA-w8hw-w9fx-j79w · GHSA-6wmf-4rv5-p3rp
• Cloudflare WAF blog · Dane Knecht on X
• OpenAI Patch the Planet · @OpenAI · Greg Brockman
• RunCloud community notice (cache; page under maintenance) · Prostack · cPanel EasyApache 4 25.91 · Plesk KB
• @takaichi_sanae · @cyber_forecast · W3Techs PHP · CISA KEV · watchTowr FAQ · Vega Threat Research on X · SecurityWeek · BleepingComputer

Related on this site: Claude Code errors guide and how to check a Mac that runs hot for a crypto miner — different problems, same habit of verifying before you reboot into a mess.