PHP2Shell: Two Critical PHP Flaws Under Attack, Patch Now

On October 21, the PHP project released emergency patches for two critical flaws, collectively called PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both are unauthenticated remote code execution (RCE) bugs in the PHP runtime, each rated 9.2 on CVSS v4.0. Details leaked about a day before the release, and attackers moved quickly. CISA published an alert urging immediate patching.

What the flaws are

• CVE-2026-109618: an out-of-memory flaw. If PHP runs out of memory while a request’s internal data is only partly initialised, the cleanup that follows can treat that data as valid.
• CVE-2026-109619: a use-after-free caused by stale state left over from one request. A later request on the same worker can use the freed memory. PHP lists memory disclosure as a confirmed impact.

Both can be triggered by an unauthenticated remote attacker. Any PHP setup that serves web requests is exposed, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php carries the highest risk, because a request can trigger the demonstrated exploit before any application code runs. Researchers at Calif report pre-authentication RCE against specific versions of WordPress, Drupal, Joomla and Magento.

Fixed versions

The earliest affected code path found dates to PHP 5.4.0, so very old installations are in scope. If you use distribution packages, check your vendor’s advisory, since vendors received patches in advance.

Exploitation status

• Amazon Threat Intelligence reports an exploitation attempt on October 17, four days before disclosure, and says attacks are now broad.
• Cloudflare reported early attacks and said attackers changed payloads to evade its firewall rules.
• watchTowr reproduced both bugs and reported active exploitation attempts on October 21.
• No source reviewed here confirms a successful break-in. We could not confirm a listing in CISA’s Known Exploited Vulnerabilities catalogue.
• Code claiming to be an exploit is circulating. Tenable has not verified it, and PHP’s team found no functional exploits at release. Treat unverified code with caution.

The bugs were reported by Wiz Research, Calif and OpenAI’s Codex Security team, working with the PHP security team and Google’s Gemini team on the fix.

What to do

1. Inventory. Find every PHP runtime you operate, including containers, shared hosting, CMS stacks and vendor appliances that bundle PHP.
2. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor’s equivalent package. PHP says updating is the only complete fix.
3. Restart all workers after patching or changing configuration.
4. Plan for unsupported versions. If you run 8.1 or older, you need a backport, an upgrade, or isolation. PHP 7.3 and older have no fix.
5. Apply interim mitigations only as a stopgap. For CVE-2026-109618, set memory_limit=-1 in a way applications cannot override and enforce request-size limits at the web server or proxy. For CVE-2026-109619, set session.upload_progress.enabled=0, and on PHP 8.5 also fatal_error_backtraces=0. These reduce exposure to specific paths but do not make a server safe.
6. Add a WAF layer if you have one. Cloudflare deployed rules for known vectors, but calls them a stopgap and they only cover traffic routed through it.
7. Look for signs of attempts in web server and PHP logs from October 17 onward, and consider isolating internet-facing apps that you cannot patch quickly, as CERT-EU advises.
8. Scan. Tenable lists Nessus plugin 369483 and Web App Scanning plugins 115719 to 115722 for detection.

Where to be skeptical

A 9.2 score with an unauthenticated network path is serious, but “active exploitation attempts” is not the same as confirmed compromises. Some leaked exploit claims, including a 10.0 severity figure, did not come from PHP. Patch first, then investigate, and do not run unvetted proof-of-concept code on production systems.

Sources

• The Hacker News: PHP issues emergency patches for two critical PHP2Shell RCE flaws
• Tenable: PHP2Shell FAQ
• CISA: Critical vulnerabilities in PHP require immediate patching
• Help Net Security: PHP2Shell, critical PHP vulnerabilities patched