PHP2Shell: a practical patch and check guide for PHP servers

The nickname for two critical vulnerabilities discovered in PHP servers is PHP2Shell. On October 21, 2026, the PHP project released emergency updates, including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, to address these flaws. These vulnerabilities, rated CVSS v4.0 9.2, allow unauthenticated remote code execution. The first flaw, CVE-2026-109618, enables RCE via out-of-memory corruption, which can occur during request handling.

The second flaw, CVE-2026-109619, involves RCE via stale global state. PHP advises all PHP installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, to be vulnerable. The highest risk is associated with mod_php, where an unauthenticated attacker can exploit the vulnerability before any application code is executed.

PHP has not specified the affected versions or the release date for the patches. The impact of these vulnerabilities is extensive, affecting various PHP runtimes such as CLI, web runtime, Apache with mod_php, php-cgi, and FrankenPHP. Distributions and LTS vendors have received the patches in advance. Attackers are exploiting these vulnerabilities early, with attempts logged by Amazon and Cloudflare within days of the disclosure.

However, no confirmed code execution has been observed yet. The recommended steps to mitigate these vulnerabilities include upgrading to the latest PHP versions, restarting all PHP-related services, and disabling session upload progress. If upgrading is not possible, other temporary measures such as limiting memory usage and using a web application firewall (WAF) can provide additional protection.