PHP2Shell: Two Critical PHP RCE Flaws and What to Do in the First Hour

On October 21, 2026, the PHP project issued updates 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to patch two severe remote code execution (RCE) vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. These flaws, dubbed PHP2Shell by Amazon Threat Intelligence, are rated CVSS v4.0 9.2 and can be exploited without any authentication. The article provides guidance on identifying the affected versions, remediation steps, and potential exploitation risks.

Both vulnerabilities are memory safety issues within PHP itself, not in frameworks or application code. CVE-2026-109618, an out-of-memory (OOM) corruption flaw, occurs when PHP encounters insufficient memory, leading to a longjmp() exit and potential memory corruption. This vulnerability can be triggered during multipart parsing, particularly when request data is not fully initialized.

CVE-2026-109619 involves stale global state, where a persistent worker retains information from a previous request, which may be used by a subsequent request before PHP initializes the new request. The affected PHP versions span across all 8.x releases, including 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The PHP project warns that all installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, are susceptible to these flaws. However, the OOM flaw may have a higher impact on mod_php, where an exploit was demonstrated to execute before any application code runs. For PHP-FPM, while no complete exploit has been confirmed, the advisory notes that the vulnerable path remains active.

PHP 8.1 and earlier versions will no longer receive updates from the PHP project, as the project reached end-of-life for these versions on December 31, 2026. Some distributions and long-term-support vendors have released their own fixes for these older versions.

The article highlights that Amazon Threat Intelligence detected exploitation attempts on October 17, four days before the official disclosure. Within hours of the patch release, new proof-of-concept exploits were observed in Amazon's honeypot network. It is assumed that scanning for vulnerable systems has already begun, and the focus should be on ensuring that your PHP version is updated to the patched release.

To remediate the OOM flaw, set memory_limit=-1 to disable the memory limit, maintain low post_max_size and upload_max_filesize values, and restrict request parameters at the proxy level. For the stale-state flaw, disable session.upload_progress.enabled in php.ini or the relevant configuration, then restart all worker processes to apply the change. On PHP 8.5, additionally set fatal_error_backtraces=0 to mitigate the vulnerability.