php2shell: What the October 2026 PHP Flaws Mean for Video Sites

On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The releases fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, the pair known as php2shell. Under the right conditions, they let an unauthenticated attacker run code on a server running PHP. The PHP Foundation puts it plainly: if you run PHP, update now.

Vodlix patched its systems before the flaws were made public. Vodlix customers did not need to do anything.

A patch protects nobody until it is on your server. For a video business, that is what php2shell comes down to.

What is php2shell?

php2shell is the name for two related remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619. Both sit in memory management and error handling, parts of PHP that nearly every request touches. The PHP project's advisories rate them critical, and fixed versions came out on October 21, 2026.

The PHP Foundation and the PHP project's advisories refer to the flaws by their CVE numbers, so use those when you search your vendors' and hosts' advisories.

CVE-2026-109618: memory corruption when PHP runs out of memory

If a request reached PHP's memory_limit at exactly the wrong moment, PHP could leave partly initialized internal data behind and later treat it as valid. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and the PHP Foundation says full remote code execution was shown with default settings. Remote code execution was also confirmed on PHP-FPM through application code paths.

CVE-2026-109619: stale state left over from an earlier request

A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request on the same worker could then use that freed memory. The reporter demonstrated remote code execution against a real-world application on Apache with mod_php, according to the PHP Foundation.

Which PHP versions fix the php2shell vulnerability?

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on October 21, 2026. Every earlier release in those four branches is affected, according to the PHP project's advisory for CVE-2026-109618. If you run PHP 8.1 or older, there is no patch for your branch.

TechCrunch reports that the holes have been in every version of PHP since PHP 5, released in 2004, and that PHP 8.1 and older are no longer supported. Sites on those versions have more work to do than a minor update.

Who found the flaws, and when?

Researcher Ryan A at the security firm Calif reported the first remote code execution to PHP on August 11, 2026, during an audit that began on July 30, 2026. Wiz and OpenAI then reported further attack paths. The root cause traces back to a memory problem the PHP team first spotted in 2024.

The PHP Foundation's own account sets out the order of events:

1. 2024: during PHP's first external security audit in years, a core developer found the first signs of the out-of-memory problem. No concrete attack path was found then, and the fix stalled.

2. July 30, 2026: Calif began an audit of PHP under the Patch the Planet program.

3. August 11, 2026: Ryan A at Calif reported an unconditional remote code execution with the same root cause. OpenAI independently reported the same root cause.

4. August 24, 2026: Wiz reported further attack vectors.

5. September 18, 2026: OpenAI reported further attack vectors.

6. October 21, 2026: PHP released the fixed versions.

The Foundation is frank about the gap: it calls the delay after 2024 "a structural failure" of the security team's decision process and its lack of resources, and says the team is changing how it works.

How serious is php2shell, and how has the internet reacted?

It is serious because PHP is everywhere and the worst case is an attacker running code on your server. TechCrunch reports that PHP powers roughly 70% of websites, and that the U.S. National Security Agency advised taking a site offline if it cannot be patched right away.

TechCrunch also reports that the holes can let attackers reach a server's file system or a database the web app uses. At the time of its report on October 21, OpenAI said the flaws were found by researchers before attackers, with no reports of exploits in the wild. Disclosure changes that, because the details are now public.

Cloud providers moved the same day. AWS published security bulletin 2026-143-AWS on October 21, 2026, marked "Important (requires attention)", for PHP web runtimes affected by both CVEs.

What does php2shell mean for a streaming platform or video site?

It means checking every part of your video business that runs PHP, not just the player. A streaming site is a storefront, a sign-in, a billing flow and often a marketing site or blog. If any of those runs PHP on a server you or your host manage, it needs a fixed version.

Security is not only an IT task here. It is a business one. A video site that goes offline to wait for a patch stops selling subscriptions and rentals for as long as it is down.

WordPress is a common case. TechCrunch reports that WordPress said the flaw is not specific to WordPress, and that sites running it must patch their servers and work with their hosting companies.

Patching is one layer of protection. Our guide to OTT security essentials for your content and viewers covers the others, and our page on login security for streaming platforms covers viewer accounts.

How did Vodlix handle php2shell?

Vodlix patched its systems against CVE-2026-109618 and CVE-2026-109619 before the flaws were made public on October 21, 2026. At Vodlix only the middleware uses PHP, and that is what was patched. Vodlix customers did not need to take any action.

On a managed platform like Vodlix, security updates like this one are applied for you. If you want to report a security concern about Vodlix, write to [email protected].

What should you do if you run your own PHP sites?

Update every PHP install you run to a fixed version, or ask your host to do it, and read your providers' advisories. If you cannot update straight away, follow the NSA guidance TechCrunch reports and take the site offline until you can.

1. List what runs PHP. Include your main site, any WordPress site or blog, landing pages and admin tools.

2. Check each version. Compare it with the table above.

3. Update or ask your host. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On a managed host, ask them to confirm the date they updated.

4. Plan an upgrade for old branches. PHP 8.1 and older are no longer supported, so a patch is not coming for them.

5. Read your vendors' advisories. Start with your host and cloud provider. AWS has published one.

6. Confirm the new version is running. Check again after the update, on every server.

What to do next

If you are a Vodlix customer, you do not need to do anything about php2shell. For questions, visit the Vodlix help center or contact the Vodlix team.

If you are weighing a managed platform so updates like this are handled for you, see the Vodlix platform features or request a Vodlix demo.