PHP: with the next release

At a glance

PHP2Shell: Red, act today. PHP uses longjmp() for out-of-memory (OOM) errors, which can lead to remote code execution (RCE). An attacker could exploit this vulnerability to execute arbitrary code on a targeted system.

The flaws

• CVE-2026-115560: With the next release
• CVE-2026-109618: Use-after-free can lead to remote code execution (CVSS 9.8 · EPSS 12%)
• CVE-2026-109619: PHP has various global state that temporarily points into request memory (CVSS 8.1 · EPSS 6%)
• CVE-2026-91765: Denial of service (CVSS 7.5 · EPSS 1%)

The fix

Fix: Check the linked advisory for a fix, as none is provided in the record.

Who is exposed: {'products': ['PHP'], 'packages': [], 'versions': ['all versions']}

Where it stands

• Exploitation reported in the press
• 6 outlets covering it

How it unfolded

1. 24 Sep, PHP releases (official): PHP 8.3.35 Released!
2. 24 Sep, PHP releases (official): PHP 8.5.11 Released!
3. 21 Oct, The Hacker News (press): PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
4. 21 Oct, Infosecurity Magazine (press): Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
5. 21 Oct, CISA advisories (US) (official): Critical Vulnerabilities in PHP Require Immediate Patching
6. 21 Oct, Ubuntu security notices (official): USN-8948-2: PHP vulnerabilities
7. 21 Oct, PHP releases (official): PHP 8.6.0 RC4 available for testing
8. 23 Oct, PHP releases (official): Informational advisory: Session upload progress
9. 23 Oct, SecurityWeek (press): Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
10. 23 Oct, BleepingComputer (press): PHP shares mitigation for new RCE vulnerability with no patch
11. 23 Oct, Dark Reading (press): Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
12. 25 Oct, Help Net Security (press): Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw

Connects to

• Same weakness: Use-after-free (CWE-416). 398 other warnings in 30 days
• Same product: Earlier PHP warnings. 7 in the last 90 days
• Reported alongside: In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can…. CVE-2026-113380 · in 1 of the same article