One command: php -v. Run it on the server and read the number. If it says 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or higher in the same line, the two critical flaws are closed. If the package comes from your distribution, PHP writes that distributions and long-term-support vendors received the patches in advance, and advises checking with your vendor for updated packages.
Fact
The facts: on October 21, 2026 PHP announced that versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. CVE-2026-109618 happens when memory runs out: PHP can be interrupted while the internal data of a request is only partly initialized. CVE-2026-109619 is internal request state that survives after its memory has been freed. In its October 20 advance notice PHP rated both CVSS v4.0 9.2. Affected are all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed; the risk is highest for mod_php, where PHP describes a demonstrated exploit: an unauthenticated request can trigger the attack before any application code runs. PHP writes that there are no complete mitigations and that updating is the only safe choice. PHP 8.1 and older no longer receive updates from the project; for PHP 7.4, 8.0 and 8.1 the team provided minimal source backports, and some distributions and long-term-support vendors offer their own. PHP 8.2 reaches end of life on December 31, 2026.
The flaw is in PHP itself. A new plugin or a fix in your own code does not close it, Cloudflare writes. PHP says the same in its own words: only an update is a complete solution. There are measures that reduce the risk, but according to PHP they do not make an installation safe.
Cloudflare writes that the two are known as PHP2Shell; the name does not appear on php.net. From October 21 at 3:02 UTC its WAF customers were protected by default, on all plans, the free one included. By Cloudflare's account that was about nine hours before disclosure. The new check looks at the server's response, not only the request.
Cloudflare's shield buys hours. The fix is the PHP version.
On October 23 a third one arrived, CVE-2026-115560, in session upload progress tracking. PHP calls it an unlikely route to code execution: it takes an unusual combination of settings and application code. PHP promises the full advisory with the next regular release, and until then the advice is session.upload_progress.enabled=0. According to Cloudflare the flaw affects fully patched versions too, 8.5.12 included. If you changed session.upload_progress.name, Cloudflare's rule does not cover you. When the next regular release lands, PHP does not say.
If you are on 8.1 or older, the project no longer ships updates for you. What is left is a long-term-support vendor's packages, the minimal source backports (only for 7.4, 8.0 and 8.1), or a move to a newer line. And if you are on 8.2, write down the date: on December 31, 2026 PHP stops fixing that one too.
Official primary sources
PHP - Security advisory (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560), 21 and 23.10.2026Cloudflare - PHP2Shell and WAF protection (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560), 21.10.2026The visual is generated code-art, no third-party images.