{
  "id": 17259907,
  "title": "PHP2Shell: a practical patch and check guide for PHP servers",
  "url": "https://urgent.news/2026/10/30/php2shell-a-practical-patch-and-check-guide-for-php-servers",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-30T17:31:51.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/abhinav_yadav_b42c8a717ab/php2shell-a-practical-patch-and-check-guide-for-php-servers-483b"
  },
  "original_language": "en",
  "account": "The nickname for two critical vulnerabilities discovered in PHP servers is PHP2Shell. On October 21, 2026, the PHP project released emergency updates, including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, to address these flaws. These vulnerabilities, rated CVSS v4.0 9.2, allow unauthenticated remote code execution. The first flaw, CVE-2026-109618, enables RCE via out-of-memory corruption, which can occur during request handling. The second flaw, CVE-2026-109619, involves RCE via stale global state. PHP advises all PHP installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, to be vulnerable. The highest risk is associated with mod_php, where an unauthenticated attacker can exploit the vulnerability before any application code is executed. PHP has not specified the affected versions or the release date for the patches. The impact of these vulnerabilities is extensive, affecting various PHP runtimes such as CLI, web runtime, Apache with mod_php, php-cgi, and FrankenPHP. Distributions and LTS vendors have received the patches in advance. Attackers are exploiting these vulnerabilities early, with attempts logged by Amazon and Cloudflare within days of the disclosure. However, no confirmed code execution has been observed yet. The recommended steps to mitigate these vulnerabilities include upgrading to the latest PHP versions, restarting all PHP-related services, and disabling session upload progress. If upgrading is not possible, other temporary measures such as limiting memory usage and using a web application firewall (WAF) can provide additional protection.",
  "summary": "What happened PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619. On October 21, 2026, the PHP project shipped emergency releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, to fix two critical flaws that it says \"can allow unauthenticated remote code execution\" ( PHP security advisory ). The day before, PHP had given advance notice that both were rated CVSS v4.0 9.2. If you upgrade,…",
  "key_points": [
    "PHP2Shell vulnerabilities discovered on October 21, 2026",
    "CVE-2026-109618 and CVE-2026-109619 allow remote code execution",
    "PHP urges immediate patching of all PHP installations"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "TechRadar",
        "title": "Chinese hackers build PHP2SHELL exploit, use it to root 25 servers, breach US government-affiliated firewalls",
        "url": "https://urgent.news/2026/10/30/chinese-hackers-build-php2shell-exploit-use-it-to-root-25-servers",
        "published": "2026-10-30T16:05:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}