PHP2Shell: Critical PHP Vulnerabilities Require Urgent Patching
Executive summary
PHP has released emergency updates for CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both are critical, rated CVSS v4.0 9.2, and can permit unauthenticated remote code execution under exploitable conditions. These are PHP runtime flaws, not individual website plugin or theme vulnerabilities. [1] [2] [3] [4]
Our assessment: prioritize emergency patching of internet-facing PHP services.
Cloudflare reports attack traffic targeting these vulnerabilities and attempts to modify payloads to evade protection. This confirms attack activity, not a reliable count of successfully compromised systems. [4]
CVE-2026-109618
Out-of-memory corruption
Memory exhaustion can interrupt request processing while internal data is only partially initialized. Cleanup may then use invalid data, potentially allowing remote code execution.
PHP confirms a demonstrated unauthenticated attack against Apache mod_php that occurs before application code runs. Application authentication cannot be relied upon to prevent that path. [2]
CVE-2026-109619
Stale global state
A worker can retain references to a previous request’s memory after it has been released. A later request handled by the same worker may access that stale state.
Confirmed impacts include memory disclosure and remote code execution in the web-worker context. Validated paths involve both mod_php and PHP-FPM, with different prerequisites. [3]
Who should take action?
PHP identifies web-serving installations including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as in scope. The PHP team considers mod_php the highest-risk deployment type. [1]
Exposure does not mean every deployment is equally exploitable. Builds, configuration and application behaviour affect the available paths. PHP-FPM is not unaffected simply because some demonstrated Apache sequences do not work against it. [2] [3]
Fixed versions
These upstream releases contain the fixes. Distribution and long-term-support vendors may supply backports with different version numbers: check the vendor advisory and package revision. Older unsupported PHP versions must not be assumed safe. [1]
Priority defensive actions
Our recommended response:
- Inventory exposed services first, including hosted sites, containers and vendor-managed applications.
- Deploy the PHP runtime fix or a confirmed vendor backport. A CMS or plugin update alone is not remediation.
- Replace or restart serving workers and verify that the patched runtime is actually handling requests.
- Restrict access to services that cannot be patched promptly.
- Retain WAF protection as defence in depth, not as a substitute for patching.
Remediation basis: PHP guidance [1] and Cloudflare guidance [4].
Temporary controls are incomplete
PHP documents configuration changes that reduce particular attack paths, including disabling session upload-progress tracking. No generic configuration workaround completely resolves both vulnerabilities. Changes must take effect at the correct request-processing stage, and workers must be restarted. Follow the official advisory rather than treating a single setting as a complete fix. [3]
Monitoring and investigation
Our recommended investigative leads include unusual concentrations of memory errors, fatal errors, execution timeouts and worker failures around suspicious requests. These are not definitive signatures: legitimate faults can look similar. Some vulnerable paths produce no predictable log entry, so quiet logs do not establish safety. [2] [3]
Where exploitation is suspected, preserve relevant logs and review for unauthorized changes or activity alongside patching. A security update is not evidence that an earlier compromise has been removed.
Bottom line and limitations
Patch the runtime urgently, verify the running deployment, and investigate suspicious activity.
This report reflects public information reviewed on 21 October 2026. Exploitability varies by deployment. Attack activity and guidance may evolve; the reviewed sources do not establish a reliable count of successfully compromised systems. This advisory does not assess any specific organization’s exposure.