What the PHP vulnerability means for enterprise

On October 21, 2026, the PHP project released fixes for two critical vulnerabilities that can let an attacker run code on a web server without logging in. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, sit in the PHP engine itself, so they affect applications regardless of how well the application code is written. CISA urged organizations to patch immediately.

For an enterprise, the hard part of this PHP vulnerability is finding every place PHP runs, deciding what to fix first, and getting tested changes merged across many teams before attackers reach the same servers.

What the PHP vulnerability is

The PHP project's advisory describes two separate bugs. CVE-2026-109618 is triggered during out-of-memory handling, which can interrupt PHP while request data is only partly set up. Cleanup code may then treat that broken data as valid. CVE-2026-109619 involves internal state that survives after its memory has been freed, so a later request handled by the same worker can use stale data.

Both bugs can lead to remote code execution. CERT-EU lists each with a CVSS 4.0 score of 9.2. According to the PHP project, every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The project rates mod_php as the highest risk, because a demonstrated exploit works before any application code runs.

Security firm watchTowr reports exploitation in the wild since October 21. Public proof-of-concept code is also circulating. Treat it as an active threat and patch outside the normal release cycle.

Which PHP versions are affected

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Linux distributions and long-term support vendors received patches in advance, so most teams should take the update from their usual package source.

Older versions are the larger enterprise problem. PHP 8.1 and earlier no longer receive official releases. The PHP project published minimal source backports for 7.4, 8.0, and 8.1 for teams that build from source, and some vendors ship backported packages. Wiz reports that every PHP version going back to 5.4 is affected by at least one of the issues. An application pinned to an old runtime now has a security deadline attached to its upgrade project.

The PHP advisory also lists temporary mitigations, such as memory limit changes. The project is clear that these reduce specific attack paths but do not make a server safe. Use them only to buy time while the real update ships.

Where enterprise teams lose time

Large organizations rarely run PHP in one place. It shows up in customer-facing sites, internal tools, content management systems, vendor appliances, container base images, and CI images that nobody has touched in a year. Each one may have a different owner, build process, and release schedule.

A typical response stalls in a few predictable places.

1. Inventory. Someone has to find every Dockerfile, package manifest, and server image that pulls in PHP, including transitive base images.
2. Prioritization. Internet-facing mod_php servers come first. Internal services and FPM deployments follow, then build images and developer tooling.
3. The change itself. Each repository needs a version bump or base image update, a rebuild, and a passing test suite.
4. Review and rollout. Owners need to review and merge the change, then deploy it through their normal pipeline.

None of these steps is difficult on its own. The problem is volume. A security team can confirm the risk in an afternoon and still wait weeks for dozens of repositories to ship a fix. That gap between knowing about a CVE and merging the fix is where most of the exposure lives.

How Factory helps close the gap

Factory is a platform for building a software factory, where agents called Droids take work from a signal, such as a security advisory, to a reviewed pull request. For a vulnerability like PHP2Shell, that means the slow, repetitive middle of the response can run in parallel across repositories while people keep control of what merges.

Find where PHP runs. A Droid can search each repository for PHP version pins in Dockerfiles, composer.json platform settings, and CI configuration. It can then report which services use mod_php and which are on unsupported versions.

Prepare the fix. For each affected repository, a Droid can update the base image or package version, rebuild, run the existing tests, and open a pull request that explains the change and links the advisory. Teams can start this from a scanner alert or advisory feed using Factory Automations, which can trigger on a schedule, a GitHub event, or an inbound webhook.

Review before merge. Factory's security review can check each pull request for new issues before a human approves it. The repository owner still reviews and merges. Droids prepare the work, and people decide what ships.

Keep code inside your boundary. Teams that cannot send source code to a hosted service can run Factory in their own environment with Factory Private. Agent Safety & Controls limit which commands a Droid can run and keep production credentials out of reach.

Factory is also model-agnostic. Teams can choose the model that fits each task, including models approved for their own environment, without changing the workflow.

What to do this week

Patch internet-facing PHP first, starting with Apache mod_php. Confirm that your distribution or vendor packages include the October 21 fixes. Rebuild container images that bundle PHP rather than assuming a host update covers them.

Then build a list of every service on PHP 8.1 or older and give each one an owner and an upgrade date. Those services carry the highest long-term risk, because the next PHP vulnerability may not come with backports.

Finally, measure how long it took to go from advisory to merged fix across your repositories. PHP2Shell will not be the last critical CVE this year. Teams that shorten that path now will respond faster to the next one.

If you want to see how Factory could handle CVE work like this across your repositories, use the form below to talk with the team.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the nickname for two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, fixed on October 21, 2026. Both can let an attacker run code on a web server without logging in.

Which PHP versions fix PHP2Shell?

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier no longer receive official releases. The PHP project published minimal source backports for 7.4, 8.0, and 8.1, and some vendors ship backported packages.

Which PHP setups are most at risk?

According to the PHP project, every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The project rates Apache with mod_php as the highest risk.

Is PHP2Shell being exploited?

Security firm watchTowr reports exploitation in the wild since October 21, 2026, and public proof-of-concept code is circulating. CISA urged organizations to patch immediately.

Are the temporary mitigations enough?

The PHP advisory says mitigations such as memory limit changes reduce specific attack paths but do not make a server safe. Use them only to buy time while the real update ships.

How can Factory help enterprises respond to PHP2Shell?

Droids can find PHP version pins across repositories, update base images or packages, run the existing tests, and open pull requests that link the advisory. Repository owners review and merge, and teams with strict data rules can run Factory in their own environment with Factory Private.

Further reading

• CVE explained: what PHP2Shell tells security teams
• Private AI security remediation
• Safer dependency updates with coding agents
• Security review docs