PHP can encounter unusual fatal-error and cleanup paths during request processing. In this flaw, internal global state may outlive the request-owned memory to which it points. Later use of that stale state can lead to unsafe memory access.
The issue is part of the two-CVE PHP2Shell disclosure on 21 October 2026. A remote code execution outcome depends on exploitability and the target environment, so an advisory or demonstration must be read with its stated preconditions rather than generalized to every website.
PHP fixed this CVE in releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The later session upload progress advisory, CVE-2026-115560, concerns a separate narrow configuration and is not evidence that this October 21 fix was ineffective.
Update the web-serving runtime or obtain a verified vendor backport, restart workers and document the package build. Inspect relevant logs and host activity because patching prevents future exploitation but does not undo a prior compromise.