What is remote code execution? RCE in plain words

WindowsMacUpdated

Remote code execution, usually shortened to RCE, is the term security advisories use when a flaw could let an attacker run their own code on a system they reach over a network. Synology's advisory on the PHP flaws fixed in October 2026 puts it as vulnerabilities that "allow remote attackers to execute arbitrary code". This guide is accurate as of 23 October 2026.

Quick answer

Remote code execution (RCE) means a security flaw could let someone run their own code or commands on a computer from elsewhere on a network. The UK's NCSC said the PHP2Shell flaws "may allow attackers to execute commands on any web server running PHP". Fixing it is the server owner's job, by updating the affected software.

What does remote code execution mean?

The clearest official wording comes from the advisories themselves. The PHP project's advisory of 21 October 2026 describes "two critical vulnerabilities that can allow unauthenticated remote code execution". The National Cyber Security Centre (NCSC) describes the same issue as one that "may allow attackers to execute commands on any web server running PHP".

The two words that matter most are "remote" and "unauthenticated". FIRST, the body that publishes the CVSS severity scoring system, says a flaw that can be attacked across a network "is often termed 'remotely exploitable'", and that the possible attackers can extend "up to and including the entire Internet". In the same document, an attacker who needs no account or login is described as "unauthenticated prior to attack".

So RCE describes what a flaw could allow, not something that has already happened.

Why is RCE rated so serious?

Because of what the attacker could do once their code runs. CVSS, the scoring system covered in our guide to CVE numbers and CVSS scores, records this as impact. The PHP project's scores for both PHP2Shell flaws mark the impact as High for confidentiality, integrity and availability. FIRST's specification describes high integrity impact with the example that "the attacker is able to modify any/all files protected by the Vulnerable System". Its example for high confidentiality impact is an attacker stealing "the administrator's password, or private encryption keys of a web server".

The same scores also record what makes an attack harder. Both PHP2Shell flaws are marked with high attack complexity and with attack requirements present. FIRST defines the first as an attack that depends on getting around security measures already in place. The second means the attack depends on specific conditions in how the system is set up and running, and FIRST notes such an attack "may need to be launched multiple times against a single target before being successful".

With all of that recorded, the PHP project's score for both flaws is 9.2 out of 10, which falls in the Critical band.

What does RCE mean if I run a website?

It means updating is urgent if your site runs an affected version of PHP. The PHP advisory says it considers the risk highest for Apache with mod_php, "with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs". In plain terms, on mod_php the attack can work before WordPress or any other site software has run at all. Which versions fix it, and what to do, are in our PHP2Shell explainer.

Start with how to check your website's PHP version. If your host manages PHP for you, my host says PHP is patched covers what's left on your side.

What does RCE mean if I only visit websites?

An RCE flaw in PHP is a flaw on the server. The PHP advisory's list of who is at risk names server software, such as PHP-FPM and Apache with mod_php, and doesn't mention web browsers or visitors' devices. As of 23 October 2026, the US agency CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication". Two related questions have their own guides: can visiting a hacked website hack you? and is my personal data at risk from PHP2Shell?

How does PHP2Shell lead to remote code execution?

The PHP advisory names the two flaws by how they reach RCE. The first is "RCE via OOM corruption" (CVE-2026-109618), where "out-of-memory handling can interrupt PHP while internal request data is only partially initialized". The second is "RCE via stale global state" (CVE-2026-109619), where "request-owned internal state can survive after its backing memory has been freed". The official CVE records add that PHP may then read or branch on request memory that is uninitialised, in the first case, or already freed, in the second. Our PHP2Shell explainer covers versions, who is affected and what to do.

More questions

What does RCE stand for?

Remote code execution. The PHP project uses the short form in the names of both PHP2Shell flaws, "RCE via OOM corruption" and "RCE via stale global state", and the official CVE records for both say the flaws can lead to remote code execution (RCE).

Is remote code execution the same as being hacked?

No. RCE describes what a flaw could allow. Being hacked means someone actually used a flaw against a system. For PHP2Shell, none of the official advisories gives a number of compromised sites. If you run a site and something looks wrong, read website hacked: what to do.

What does "unauthenticated" mean in an advisory?

It means the attacker doesn't need to be logged in, or to have an account or password on the system at all. FIRST's CVSS specification says such an attacker "does not require any access to settings or files" before the attack.

Is every RCE flaw rated critical?

No. The score depends on how easy the attack is and what it needs, as well as the impact, and different scorers can disagree: the US National Vulnerability Database rated CVE-2026-109619 High, not Critical. Our guide to CVE numbers and CVSS scores compares the scores.

Is RCE a type of vulnerability?

Yes. The CVE Program defines a vulnerability as a weakness in a product "that can be exploited", with a negative impact on confidentiality, integrity or availability. RCE describes one thing such a weakness can allow. Our guide to what a vulnerability is explains the wider term.

Sources