PHP2Shell is the nickname used in vendor and government notices for CVE-2026-109618 and CVE-2026-109619. PHP’s own announcement does not need the nickname: it describes two critical remote code execution vulnerabilities and tells users to update.
Both issues sit in request handling inside php-src. One is an out-of-memory path that can leave request memory in an invalid state. The other is global state that can still point at memory from a previous request on the same worker. They are separate bugs. PHP tells readers of each advisory to follow the other as well.
What it is not
It is not a flaw in the Nginx or Apache binaries. Those servers decide how a request reaches PHP. The memory-management and state-reset code that the advisories describe belongs to PHP.
It is not fixed by updating only the application. A current WordPress, Drupal, or Laravel release still executes on whatever PHP binary the vhost uses.
It is not a single package version that every operating system shares. Upstream tags are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Ubuntu, Debian, and AlmaLinux published their own package revisions, and several of those revisions keep an older upstream version string.
Why the worker model matters
PHP web SAPIs handle more than one request in a process. State that should die with one request can be visible to the next request on that same worker. That is why a restart, not only a package install, is part of the change: old workers keep the old code until they exit.
Questions
Who assigned the nickname?
Public notices from Ubuntu, AlmaLinux, CISA, and the Canadian Cyber Centre use php2shell for this pair of CVEs. PHP's own advisory uses the CVE numbers.