PHP 8.2-8.5 Critical Flaws Enable Remote Code Execution

On October 21, 2026, the PHP project released security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can enable unauthenticated remote code execution with CVSS scores of 9.2. The vulnerabilities, collectively known as "PHP2Shell," affect PHP versions 8.2 through 8.5, with CVE-2026-109619 also potentially exposing memory. Salesforce reports no evidence of exploitation affecting its systems or customer data, but recommends organizations patch on an expedited schedule as threat actors may begin leveraging the vulnerabilities. The PHP Security Team states no complete mitigations exist, making updates the only safe choice. Backports are available for older PHP versions, and Heroku has published patched runtimes for customers. While exploit demonstrations exist, reporting does not establish widespread successful exploitation.