PHP2Shell: Critical PHP Remote Code Execution Flaws Require Emergency Patching

The PHP Security Team has released emergency security updates for two critical remote code execution (RCE) vulnerabilities, tracked together as PHP2Shell. The flaws are identified as CVE-2026-109618 and CVE-2026-109619.

The vulnerabilities affect PHP installations that handle web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Research from Calif.io, Wiz, and OpenAI helped identify and disclose the flaws.

“We believe mod_php poses the highest risk due to demonstrated exploits where unauthenticated requests can trigger attacks before application code is executed,” the PHP Security Team said.

PHP2Shell vulnerabilities enable remote code execution

Both vulnerabilities stem from the same underlying issue: when a request terminates abnormally, PHP can leave memory in a corrupted state. Attackers can potentially exploit this condition to execute code remotely.

CVE-2026-109618 can lead to remote code execution as a web worker account by exploiting a series of vulnerabilities that cause out-of-memory corruption.

CVE-2026-109619 involves a longstanding global-state issue that allows unauthenticated heap use-after-free conditions, memory disclosure, and remote code execution with web worker privileges.

PHP versions affected and fixed releases

Administrators should install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 on servers running PHP 8.x as soon as possible. Organizations running PHP 7 or earlier should migrate to a fixed release.

“PHP 8.1 and earlier no longer receive updates from the PHP project. Some distributions and LTS vendors offer backported fixes, so please contact your vendor for more information or upgrade to a supported version,” the PHP developers said.

Because of the severity of the vulnerabilities, the PHP Security Team also provided minimal source backports for older versions. These are available for PHP 7.4, PHP 8.0, and PHP 8.1 for administrators building PHP from source or operating without access to an LTS vendor.

PHP developers issued advance warning

The emergency release follows an earlier warning from PHP developers urging administrators to prepare to install the security updates as soon as they became available.

“We encourage all PHP users to prepare now to upgrade as soon as a release is available,” the developers said. “We reserve the right to release early if details of the vulnerability become public, or if evidence of active exploitation emerges.”

PHP Core Developer Gina Peter Banyard warned that PHP2Shell mitigations cannot completely block potential attacks. Applying the official security patches is the only permanent defense.

Before the patches were released, Cloudflare CTO Dane Knecht confirmed that the company had already observed attacks targeting the vulnerabilities. Cloudflare had deployed WAF rules designed to block known PHP2Shell exploits, but Knecht emphasized that these protections are temporary and urged administrators to install the PHP updates as soon as possible.

The UK National Cyber Security Centre (NCSC) also warned UK organizations to update their PHP systems immediately or take affected systems offline until the patches are applied.

Temporary PHP2Shell mitigation measures

The PHP Security Team has shared several mitigations to reduce exposure for organizations that cannot immediately patch their servers. These steps do not completely prevent exploitation. Additional information is available in the PHP security advisory.

Mitigations for CVE-2026-109618

• Set memory_limit=-1, preferably in a way the application cannot overwrite, such as with php_admin_value in an FPM pool or Apache configuration.
• Set a low post_max_size: 8M for applications that do not require file uploads, or 32M for applications that do.
• Use container or cgroup limits as availability boundaries, preferably with a policy that only terminates affected workers.

Mitigations for CVE-2026-109619

• Set session.upload_progress.enabled=0 and restart all workers.
• In PHP 8.5, set fatal_error_backtraces=0 and restart all workers. This blocks only confirmed fatal backtrace paths.
• Remove invalid or deprecated per-request configurations and emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors, or @ does not prevent exploitation.
• Fix attacker-reachable fatal errors and execution timeouts, including those involving callbacks, upload or import processing, and cleanup failures.

Why PHP2Shell affects millions of websites

PHP, or Hypertext Preprocessor, is an open-source, server-side web development language used by an estimated 75% to 80% of websites, including sites built with content management systems such as WordPress, Joomla, and Drupal.

According to a VirusTotal estimate, more than 5.1 million PHP hosts are online, with approximately 3.8 million exposing at least one open port.

The overall prevention score can hide what happens after initial access. If an attacker uses valid credentials, your defenses can drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report