Critical PHP Vulnerabilities (PHP2Shell): CVE-2026-109618 & CVE-2026-109619

Photo by Michael Geiger on Unsplash

What Just Happened?

On 21 October 2026, the PHP project released emergency security updates addressing two critical vulnerabilities in the PHP runtime: CVE-2026-109618 and CVE-2026-109619. Collectively, security researchers and authorities have nicknamed them PHP2Shell.

Both flaws allow unauthenticated remote code execution (RCE) — an attacker can run arbitrary code on a vulnerable PHP server without logging in or sending any authentication request. The vulnerabilities are rated CVSS 9.2 (Critical) on both the CVSS v3.1 and v4.0 scales.

This is one of the most serious PHP security events in recent years. Because PHP powers a large share of the web — including WordPress, Laravel, Drupal, and countless internal and enterprise applications — the impact surface is enormous.

If you run any PHP-based service, this is a patch-now situation.

The Two Flaws, Explained

CVE-2026-109618: Out-of-Memory (OOM) Corruption

PHP enforces its memory_limit setting using longjmp() to abort any request that exceeds the limit. This raises an out-of-memory (OOM) error. The problem: the abort can leave partially-initialized internal request data behind.

When PHP later cleans up that request, it may treat the invalid, partially-initialized data as valid, corrupting memory. Attackers can manipulate the data PHP encounters in this invalid memory state to:

• Crash a PHP process
• Expose sensitive information
• Execute arbitrary code

The researcher’s description: “Request cleanup may then treat the invalid data as valid and try to free memory that was never initialised. That memory may still contain data from earlier allocations controlled by the attacker.”

CVE-2026-109619: Stale Global State (“Use After Free”)

This vulnerability is about stale global state. Internal state owned by a request can survive after its backing memory has been freed — for example, after a fatal error. A later request handled by the same worker process may then use that stale state before normal initialisation resets it.

This is a classic use-after-free (CWE-416). Attackers who trigger the right error conditions can cause:

• A use-after-free in the worker
• A worker crash
• Remote code execution against a real-world application running on Apache with mod_php

The researcher’s description: “A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request handled by the same worker could then use that freed memory.”

Key Technical Facts

What’s the Attack Path?

The demonstrated exploit shows that one unauthenticated request can trigger the attack before any application code runs. This is the part that makes PHP2Shell especially dangerous.

The attack chain works like this:

1. Trigger. The attacker sends a request to the PHP web server that forces a memory-management or fatal-error path (e.g., an out-of-memory condition, or a deliberate fatal error).
2. Corruption. PHP’s longjmp() abort/cleanup routine leaves partially-initialized internal data or stale global state behind.
3. Reuse. A subsequent request handled by the same worker process (same worker = same PHP engine instance) reads that freed/partially-initialized memory as valid.
4. RCE. Through the crafted data, the attacker runs arbitrary code with the privileges of the PHP worker process.

Because the worker persists across requests in PHP-FPM and other multi-worker configurations, the attack can be repeated without ever sending an authentication token.

Affected Systems

Every PHP installation that serves web requests is at risk, including:

• PHP-FPM (FastCGI Process Manager)
• Apache with mod_php
• php-cgi
• FrankenPHP
• LiteSpeed
• Any other web-server integration that runs PHP

The vulnerability affects all versions of PHP — from PHP 5.4 through 8.5.11. The following branches no longer receive updates and remain at risk with no official fix:

• PHP 8.1 and older (end-of-life)

What the Authorities Are Saying

Several cybersecurity bodies have issued guidance:

U.S. (CISA & NSA)

“All PHP users are strongly encouraged to update immediately.” — CISA
“PHP2Shell could allow attackers to take control of affected web servers without prior access or authentication.” — NSA
Recommended actions:
– Inventory all systems running any version of PHP
– Apply patches immediately, prioritising internet-facing systems
– Isolate or take offline exposed applications that cannot be patched now
– Monitor worker processes for suspicious activity (shells spawning, tools downloading)

Europe / UK (CERT-EU, ENISA, NCSC-UK)

“Organisations should isolate internet-facing applications from public networks until a fix is applied and verified.” — CERT-EU
“Where immediate remediation is not feasible, consider taking the system offline until it can be fully mitigated.” — NCSC-UK

Singapore / Canada

“Patch immediately.” — CSA Singapore
Identify affected systems and apply the appropriate updates immediately. Prioritise internet-facing systems. — Cyber Centre Canada

Industry (Cloudflare, Google, Palo Alto Unit 42)

All three independently confirmed the same technical root cause (OOM handling + stale global state), the same CVSS 9.2 severity, and the same “patch immediately” message.

Who Is at Risk?

You are at risk if any of the following apply:

• Your web server runs PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, or LiteSpeed
• You are using an unofficial/forked PHP (e.g., a vendor bundle, a Docker image tagged 8.x, a custom build) that has not received the security updates
• You are still on an end-of-life branch (PHP 8.1 or older) with no path to updates
• Your content management system, framework, or admin panel is PHP-based (this includes WordPress, Laravel, Drupal, and most PHP frameworks)
• You were not notified by your hosting provider of the security release

How to Remediate (Patch-Now Checklist)

1. Inventory your PHP installations. Search your environment for php binaries, web-server workers, Docker images, and third-party components that embed PHP.

2. Update to the patched versions:
   – PHP 8.5.x → 8.5.12
   – PHP 8.4.x → 8.4.27
   – PHP 8.3.x → 8.3.36
   – PHP 8.2.x → 8.2.35

3. Redeploy your applications. After the update, redeploy all PHP applications and restart all PHP-FPM/Apache workers so the new binary is in use.

4. If you cannot update right now, take affected internet-facing systems offline until they can be patched, or isolate them from public networks.

5. Monitor worker processes for suspicious activity:
   – Unexpected shells spawning from PHP worker processes
   – Network connections to unknown hosts
   – Downloaded tools or scripts in /tmp, /dev/shm, or application temp directories

6. Apply temporary mitigations while waiting for a full update:
   – Add enhanced logging
   – Replace end-of-life PHP services
   – Consider a web application firewall (WAF) as a stopgap

7. Check for third-party applications that embed PHP (some appliances, monitoring tools, and embedded systems bundle PHP without obvious markers).

What Should Blog Readers (DevOps/Platform Engineers) Do Next?

For the DevOps/Platform Engineer audience, the key takeaways are:

• Audit your inventory now. Count every PHP installation, worker, and PHP-embedded component.
• Patch in the next maintenance window if you can’t service immediately — but isolate internet-facing boxes first.
• Treat this as a platform-level vulnerability, not an application-level one. The fix is runtime, not code.
• Watch for follow-ups. CISA, NSA, and the PHP Security Team will likely publish additional guidance as the community scans for exploitation.

Summary

This article is based on the PHP Security Team advisory, CERT-EU Security Advisory 2026-018, ENISA joint statement, CISA/NSA guidance, and Palo Alto Networks Unit 42 analysis, all published 21 October 2026.

WILO — What I Learned Online

Related Articles

• The Linux Command Line: What Actually Gets You Through the Work
• Mastering Linux: The Essential Toolkit for Resource Monitoring (50+ Commands with Examples)
• Getting Started with Docker: A Beginner’s Guide to Containerization – Master Modern Infrastructure Today

Frequently Asked Questions (FAQ)

Q: What is the PHP2Shell vulnerability?
A: PHP2Shell is the nickname for two critical vulnerabilities in PHP — CVE-2026-109618 and CVE-2026-109619 — that allow unauthenticated remote code execution (RCE) with a CVSS score of 9.2, discovered and patched on 21 October 2026.

Q: Can PHP2Shell be exploited without authentication?
A: Yes. Both CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution, meaning an attacker can run arbitrary code on a vulnerable PHP server without logging in or sending any authentication request.

Q: Which PHP versions are affected by PHP2Shell?
A: All PHP versions from 5.4 through 8.5.11 are affected. The vulnerabilities are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older (end-of-life) receive no official fixes.

Q: How can I check if my server is vulnerable to PHP2Shell?
A: Verify your PHP version with php -v. If it shows 8.5.x before 8.5.12, 8.4.x before 8.4.27, 8.3.x before 8.3.36, or 8.2.x before 8.2.35, you are vulnerable and must upgrade immediately.

Q: Is there a way to mitigate PHP2Shell without upgrading immediately?
A: Yes. As a temporary measure, isolate or take offline internet-facing PHP systems until a patch can be applied, add enhanced logging, consider a web application firewall (WAF), and monitor worker processes for suspicious activity.

Q: What is the CVSS score of the PHP2Shell vulnerabilities?
A: Both CVE-2026-109618 and CVE-2026-109619 have a CVSS score of 9.2 out of 10, classified as Critical severity.

Q: Who discovered and disclosed the PHP2Shell vulnerabilities?
A: The PHP Security Team discovered and disclosed the vulnerabilities on 20 October 2026, with a security release issued on 21 October 2026. The CERT-EU, ENISA, CISA, NSA, and other cybersecurity authorities independently confirmed the findings.

Q: Does PHP2Shell affect WordPress sites?
A: Yes. WordPress is built on PHP, so any WordPress installation running an affected PHP version (before 8.5.12, 8.4.27, 8.3.36, or 8.2.35) is at risk of unauthenticated remote code execution.

Q: What should I do if I cannot update PHP immediately?
A: If an immediate update is not feasible, take affected internet-facing systems offline until they can be patched or updated, or isolate them from public networks. Review PHP’s official guidance for temporary measures to reduce exposure.

Q: How long has the PHP2Shell vulnerability been known?
A: The PHP project announced the upcoming security release on 20 October 2026, and released patches on 21 October 2026 at 13:30–13:40 UTC. The vulnerabilities were assigned CVE-2026-109618 and CVE-2026-109619.

WILO — What I Learned Online