So PHP just shit the bed. Hard. And this time it is not exaggerated.

You probably saw PHP2Shell flying around yesterday. CVE-2026-109618 and CVE-2026-109619. Both CVSS 9.2, both unauthenticated RCE. Leaked on October 20 before the patch was even out. Patch dropped today October 21 at 14:00 UTC. Fix versions are 8.5.12, 8.4.27, 8.3.36, 8.2.35.

What is it? Both live in how PHP handles file uploads, that multipart/form-data parsing plus session.upload_progress crap that runs before your code even runs. So you do not need an account, you just send a crafted upload request and you own the box.

CVE-2026-109618 is OOM corruption. Trigger an out-of-memory during the request, PHP does a longjmp and leaves memory uninitialized. Attacker shapes it into code exec.

CVE-2026-109619 is stale global state. Fatal error handling with longjmp leaves globals pointing to freed memory. Next request reuses it. Boom, RCE again.

Palo Alto says they saw PoC already and counted 22.6 million exposed instances. At least one European government took their site offline as precaution. Sansec says expect mass scans within 15 minutes of release. Yeah that bad.

Is it exaggerated? No. This is as bad as it gets for shared hosting, WordPress, Laravel, every CMS from here to hell. Highest risk is Apache with mod_php. PHP-FPM also vulnerable, just slightly less fucked.

What to do RIGHT NOW:

• Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. That is the only safe choice per PHP itself.
• Then restart PHP-FPM and all long workers: queue workers, Horizon, Reverb, all of it.
• Ubuntu check with apt-cache policy php8.3-fpm first. Sury already has it, old Forge PPA was still serving old builds at 13:50 UTC today.
• Cannot patch yet? Set session.upload_progress.enabled=0, set memory_limit=-1 so apps cannot override, lower post_max_size to 8M, on 8.5 set fatal_error_backtraces=0. This reduces exposure but does NOT fix it.
• PHP 8.1 and older get no official build. PHP published source backports for 7.4, 8.0, 8.1. You compile or you die.

And that is on top of the September batch: CVE-2025-1218, CVE-2025-14181, CVE-2026-17545, CVE-2026-6103, CVE-2026-91765 through 91769, CVE-2026-92842, CVE-2026-93682. Fixed in 8.2.34, 8.3.35, 8.4.26, 8.5.11. Mostly DoS, info leak, data tamper. Medium severity, but still patch.

2026 so far: 29 PHP CVEs, average 6.1. Last year 15 total. So yes, more and meaner.

For me: I run PHP everywhere. This one made me patch same day. No waiting, no "let us test in staging for two weeks". Upload parsing RCE before auth is game over. Patch now, check logs for weird upload spikes, rotate secrets if you were exposed.

If you are still on PHP 7.4 in production in late 2026, I cannot help you. Well I can: update, asshole.

That is my take. Flame me.