PHP2Shell: Critical PHP RCE Flaws CVE-2026-109618 and CVE-2026-109619
Muhammad Fikri Gunawan · · 4 min read
Two critical, unauthenticated PHP remote code execution flaws (PHP2Shell, CVSS 9.2) were patched on October 21, 2026. Here is who is affected, which versions are fixed, and what to do now.
On October 21, 2026, the PHP security team released emergency patches for two critical remote code execution (RCE) flaws nicknamed PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both can be exploited without authentication, are rated CVSS 4.0 9.2, and affect almost every web server that runs PHP. The only complete fix is to update PHP now.
What Is PHP2Shell?
PHP2Shell is the name for two critical flaws in the PHP core that let an attacker run code on the server with the privileges of the web worker. Both come from the same underlying problem: PHP can leave its memory in a corrupted state when a request ends abnormally.
- CVE-2026-109618 (RCE through out-of-memory corruption): if memory runs out while internal request data is only partly initialized, the cleanup that follows treats that invalid data as valid.
- CVE-2026-109619 (RCE through stale global state): request-owned internal state survives after its memory is freed, and a later request on the same worker can use it. Memory disclosure is a confirmed impact.
According to BleepingComputer, the discovery is credited to researchers from Calif, OpenAI, and Wiz.
Who Is Affected?
Every PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team rates mod_php as the highest risk because a demonstrated exploit runs before any application code. Calif's analysis traces the earliest affected code path back to PHP 5.4.0. WordPress, Laravel, and other CMS sites are affected too, because the flaw is in PHP itself, not in the application.
Which PHP Versions Are Safe?
- PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the fix.
- PHP 7.4, 8.0, and 8.1 get no official release, only minimal source backports from the PHP security team.
- PHP 5.4 through 7.3 are end of life and receive no fix from the PHP project.
- Linux distributions and LTS vendors received the patches in advance, so check your vendor advisory (Debian, Ubuntu, Red Hat, Alpine, or the Docker PHP images).
Is PHP2Shell Being Exploited?
There are strong signs that it is. Amazon Threat Intelligence reported exploitation attempts since October 17, 2026 and says PHP2Shell is now broadly exploited. Cloudflare also saw early attacks and deployed WAF rules, and watchTowr reproduced both flaws. CISA said it had not observed exploitation at the time of its alert, and as of October 22 neither CVE is in the KEV catalog. Public proof-of-concept code is circulating but is unverified. Treat the risk as real.
What Should You Do Right Now?
- Check the PHP version that actually serves your website, not only the command line version.
- Update to a fixed version, or install your vendor's patched package.
- Restart all PHP workers (PHP-FPM or Apache) after the update.
- If you run PHP 8.1 or older, plan a migration. CISA advises taking PHP systems offline if they cannot be updated.
- Review logs from October 17, 2026 onward for signs of exploitation, as Amazon recommends.
Temporary Mitigations If You Cannot Update Yet
PHP stresses that these steps only reduce exposure and do not make a server safe.
- For CVE-2026-109618: set memory_limit=-1 through php_admin_value in the PHP-FPM pool or Apache config, and make sure no other setting re-applies a finite limit.
- Set a low post_max_size (8M without file uploads, 32M with uploads) and keep upload_max_filesize below it.
- Enforce request limits at the web server or proxy, and use a container or cgroup memory limit. Do not use RLIMIT_AS or RLIMIT_DATA.
- For CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini or the pool config, not with ini_set().
- On PHP 8.5, also set fatal_error_backtraces=0.
- Restart every worker after making these changes.
Conclusion
PHP2Shell is one of the most serious PHP vulnerabilities in years because it is unauthenticated, affects every web SAPI, and is already being probed in the wild. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as you can, restart your workers, and use the temporary mitigations only as a stopgap.
Frequently Asked Questions (FAQ)
What is PHP2Shell?
PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two critical remote code execution flaws in the PHP core, patched on October 21, 2026.
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 7.4, 8.0, and 8.1 only have source backports, and PHP 5.4 through 7.3 have no fix.
Does PHP2Shell require authentication?
No. According to the PHP security team, an unauthenticated remote attacker can exploit both flaws.
Is my WordPress site affected by PHP2Shell?
Yes, if it runs on a PHP version that has not been fixed, because the flaw is in PHP itself. Update PHP from your hosting panel, or ask your hosting provider to do it on shared hosting.
Are the temporary mitigations enough?
No. They only reduce exposure to specific attack paths. Updating PHP is the only complete fix.
Sources
- PHP Security Advisory, php.net, October 21, 2026.
- BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws.
- Tenable: PHP2Shell (CVE-2026-109618, CVE-2026-109619) frequently asked questions.
