PHP2Shell Took Public Sites Offline Over a Memory Bug

On 21 October 2026 the PHP project published emergency releases for two bugs now called PHP2Shell. CVE-2026-109618 is corruption when a request runs out of memory. CVE-2026-109619 is state left behind for the next request on the same worker. Both are scored 9.2. Both can let an outsider run code. CISA told operators to move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or take the PHP systems offline until they can.

Public sites went dark while people waited. Dutch and Finnish agencies pulled public web services as a precaution, and France's interior ministry took local-government admin sites offline.

mata.network is not in that queue. The site, and the Remade services it stands on, are Rust. PHP2Shell lives in PHP's request memory. Safe Rust does not keep a previous request's freed buffer as ordinary code. The rebuild of those primitives is Remade with Rust. Ship notes for that work go to futureweb.news.

Trust is a service you can read, not a worker that frees the wrong block and keeps going. Security is the bug class gone at compile time, not a firewall rule until Thursday. Incentive is a site that stays up because it was never the runtime agencies told people to unplug. The Electronic Frontier Foundation has the long file on software that fails open when memory is mishandled.

How PHP2Shell Left a Request's Memory Half-Built

Both bugs sit where almost every request passes: memory accounting and the path that runs when a request dies early. The PHP Foundation says a request that hits the memory limit at the wrong moment can leave internal data only partly initialized. Cleanup can then treat that data as live. The sibling bug lets state from one request survive after its memory is freed, so a later request on the same worker may use it. Maintainers confirmed a use-after-free and a worker crash on the second bug, and remote code execution on both, including against a real application on Apache's PHP module.

They are not new this morning in the sense of a fresh typo. Wiz, one of the firms that reported them, said the underlying flaws had been present for decades, and that showing they were reachable took work at the edge of what a person could do by hand. Reports came in August and were held until a fix could ship. On 20 October the CVE numbers leaked early, with a wrong score of 10. The score the project published is 9.2. The release moved up to 21 October. ENISA, with European partners, told organizations to act the day those builds landed.

PHP remote code execution Is Why the Sites Went Dark

The PHP project says every install that serves web requests is in scope: PHP-FPM, Apache with the PHP module, php-cgi, FrankenPHP, and LiteSpeed. Risk is highest on the Apache module, where an unauthenticated request can trigger the out-of-memory bug before the site's own code runs, with default settings. A web application firewall can block some known patterns for a while. It does not close the bug. CISA's alert said the agency had not observed exploitation at publication. The same day, Cloudflare's chief technology officer said attacks were emerging, and WatchTowr said attempts reached its sensors as the patches landed. Those reports can both be careful and both be real. The instruction does not wait on them.

PHP2Shell can run before the page does

WordPress, Drupal, Joomla, and Magento are the names people recognize. The bug is under them. If the server module handles the request, the application's first line is not a shield. PHP remote code execution here is a property of the runtime, which is why taking the site offline was the advice for anyone who could not install the new builds the same hour. A theme update does not fix it.

A second request can inherit PHP2Shell's leftovers

The stale-state bug is the other half. A fatal error at the wrong point can leave the worker pointing at memory that belonged to the request before. The next request, same process, may treat that memory as its own. Maintainers say that can crash the worker, expose process memory, or run code as the account the worker uses. This is the class of bug a memory-safe language is built to refuse. It is not a missing header check.

Old PHP has no ordinary PHP2Shell update

PHP 8.1 and older no longer receive normal releases from the PHP project. The security team still published minimal source backports for 7.4, 8.0, and 8.1, for people who build from source or have no long-term vendor. Everyone else on those branches was told to upgrade, or to take the system offline. That is why the outage was wider than a single ministry. A runtime you cannot update is a runtime you have to unplug.

A mata.network Request Never Enters PHP2Shell

The website is Rust, built ahead of time. There is no PHP worker in the request path, no Apache PHP module, and no PHP-FPM pool to leave half-initialized. The NIST Secure Software Development Framework asks for memory-safe languages in this layer. Remade with Rust is that ask, applied to the site and to the services under it: identity, storage, and media. A use-after-free of the PHP2Shell kind is a compile error in safe Rust, not an emergency release.

The Home Computer is not a PHP2Shell host

DLDeploy flashes ESP32 boards that report to the Home Computer. That path is not a PHP content system, and it does not become one by sitting on the same desk as an old blog. Era 3 is files on a machine you hold. The Freedom Guide is how a person starts that move. A document you do not want in a PHP upload form can be turned into private chunks with ragconverter.com, in the browser. Neither of those is a patch for WordPress. They are a different address.

A WordPress site you still run is still PHP2Shell's problem

Honesty, before the slogan. Our stack being Rust does not reach a PHP site you host somewhere else. If that site serves web requests on an unfixed PHP, it is in the set CISA described. Install 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or take it offline until you can. The advisory is the PHP Foundation's note from today. We are not a second copy of that patch.

Remade with Rust removes the class, not the Tuesday

Patching PHP is the correct act for a PHP host, and agencies were right to say so. The longer act is to stop building the public site on a runtime whose error path can free the wrong memory. What a distributed cloud is is the mesh those services join. Why the distributed cloud needs memory-safe Rust is the argument. The importance of Remade with Rust is the catalog. PHP2Shell is the week that argument stopped being abstract: governments unplugged sites because a C request worker could not prove the next request was a new request.