INFORMATICS

PHP2Shell – Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619). What You Need to Know and How to Protect Your Servers

On 21 October 2026, the PHP project released an emergency security update addressing two critical vulnerabilities in the PHP core itself. Known in the security community as PHP2Shell, these flaws allow unauthenticated remote code execution (RCE). Both have been rated CVSS v4.0 9.2.

They affect virtually all PHP installations that serve web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The highest risk is associated with mod_php, where an attacker can trigger the exploit before any application code runs.

How do the vulnerabilities work?

CVE-2026-109618 – RCE via OOM (Out-of-Memory) corruption
When PHP runs out of memory while processing a request (for example during a large multipart file upload), it aborts and begins cleanup. In certain conditions the internal request data structures are only partially initialised. The cleanup routine still treats them as valid, leading to memory corruption that can be leveraged for remote code execution.

CVE-2026-109619 – RCE via stale global state (use-after-free)
Internal state belonging to one request can survive after its memory has been freed. A subsequent request handled by the same worker may use that stale state before PHP resets it. One confirmed attack path involves the session upload-progress feature, which is enabled by default.

Because the bugs live in the PHP engine itself, even a fully patched application (WordPress, Joomla, Drupal, Laravel, etc.) remains vulnerable if it runs on an unpatched PHP version.

What are the risks?

• Complete server takeover (code execution under the privileges of the PHP process)
• Theft of passwords, authentication tokens, API keys and certificates from process memory
• Installation of backdoors, ransomware or cryptominers
• Lateral movement to other services on the same host
• Mass scanning and exploitation already observed in the wild (reported by Amazon Threat Intelligence and others)

Given that PHP powers the majority of websites worldwide, the potential impact is extremely high.

Affected versions and fixed releases

Updating PHP is the only complete fix.

Temporary mitigations (if you cannot upgrade immediately)

1. Set session.upload_progress.enabled = 0 in php.ini
2. On PHP 8.5 also set fatal_error_backtraces = 0
3. Configure pm.max_requests = 1 (PHP-FPM) to reduce the chance of state reuse across requests
4. Restart all PHP workers (Apache, PHP-FPM, etc.)

These measures only reduce risk; they do not eliminate the vulnerabilities.

Recommended actions right now

1. Check your PHP version: php -v
2. Upgrade to the latest patched release in your branch
3. Restart PHP/Apache/Nginx services
4. Monitor logs for suspicious multipart/form-data requests
5. If you use shared hosting, contact your provider and request an immediate update

Sources: Official PHP security advisories (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp), CERT-EU, security research from Wiz, JFrog and Amazon.

Updating PHP should be the top priority for every web server administrator.