top of page
Search

What Is PHP2Shell? How the Critical PHP RCE Flaws Work, Who’s at Risk, and How to Detect, Patch & Protect Your Servers

4 hours ago
24 min read
PHP2Shell security vulnerability showing PHP code, cyberattack warnings, and server shell access.

PHP2Shell is the name given to two critical vulnerabilities in the PHP runtime itself, CVE-2026-109618 and CVE-2026-109619, that can let an unauthenticated attacker run code on a web server or read sensitive worker memory when the right conditions exist. Both score 9.2 under CVSS v4.0 and both were fixed on October 21, 2026. Updating WordPress, Drupal or any other application does not repair them. A patched PHP build, followed by a restart of every web-serving worker, is the only complete remedy.


TL;DR


  • Two flaws: CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), each rated Critical at CVSS v4.0 9.2.

  • Exposure: Any PHP installation serving web requests can be affected, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, but the confirmed attack paths differ by server type.

  • Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026. Vendor packages may carry the fix under older version numbers, and PHP 8.1 and older are upstream end-of-life.

  • Evidence: AWS and Cloudflare reported exploit attempts, AWS from October 17. Attempts are not proof of widespread successful compromise.

  • Priority: Inventory every PHP runtime, patch internet-facing systems first, restart all workers, and verify what is actually running. Mitigations are partial, and a clean log is not proof of safety.


What Is PHP2Shell? (Quick Answer)


PHP2Shell is a family of two critical memory-safety flaws in core PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Under certain conditions they let unauthenticated attackers execute code as the web worker or read process memory. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or vendor builds with the backported fixes, are the only complete remedy.

PHP2Shell Emergency: What Is Your PHP Server's Patch Status?

  • 0%Patched and verified

  • 0%Updating now

  • 0%Patch planned, not installed

  • 0%Still checking if we're vulnerable


Table of Contents



What Is PHP2Shell?


PHP2Shell is the shared name for two critical vulnerabilities in the core of PHP, the server-side language that runs a large share of the web. The name comes from the research team that disclosed them alongside the PHP project. It does not describe a single uploaded web shell, a malicious plugin or a bug in one content management system. These are memory-safety flaws in the engine that executes PHP, so sites built on PHP with well-written application code can still be exposed.


The first, CVE-2026-109618, is titled "RCE via OOM corruption." When PHP runs out of memory at the wrong moment, it can abandon a request while internal data is only partly initialized, and cleanup then treats that invalid data as valid. The second, CVE-2026-109619, is titled "RCE via stale global state." Data owned by one request can stay referenced after its memory is freed, and a later request handled by the same worker can use it. Both are rated Critical.


Remote code execution (RCE) means an attacker can run commands of their choosing, here with the privileges of the web worker account. These flaws drew an emergency release because of where they sit. For Apache with mod_php, PHP's advisory describes a path that runs before application code starts, so input validation and framework defenses in the web application never get a chance to intervene. Other server types have narrower confirmed paths, covered below.


PHP2Shell at a Glance and Disclosure Timeline


The facts below were verified against primary sources on October 24, 2026. Scores are CVSS v4.0, not v3.1, and a score describes impact potential rather than proof that every deployment can be exploited.


Item

Detail

Name

PHP2Shell: two vulnerabilities in core PHP

Identifiers

CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)

Severity

Critical, CVSS v4.0 9.2 each

Vector notes

Network, attack complexity high, attack requirements present, no privileges, no user interaction

Authentication

None required

Layer

PHP runtime and request lifecycle, below application code

Confirmed impact

Unauthenticated RCE as the web worker (mod_php, CVE-2026-109618); use-after-free, memory disclosure and RCE (CVE-2026-109619)

Advisories and fixes

Published October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35


The timeline keeps research, observed attempts, disclosure and fixes separate, because they are different kinds of evidence.


Date (UTC)

Event

Evidence type

Aug 11

Calif reports unconditional RCE sharing the root cause of an OOM problem first noticed in 2024, per the PHP Foundation

Research

Aug 19-24

Wiz Research finds, confirms and reports its own chains, per its timeline

Research

Oct 17

AWS MadPot records one exploit attempt from an anonymization network

Observed attempt

Oct 20

CVE identifiers leak; PHP publishes a pre-announcement and moves the release forward

Disclosure

Oct 21

Cloudflare WAF protections active from 03:02; proofs of concept circulate; fixed releases ship around 14:00

Observed attempts, fix

Oct 22

AWS adds a managed WAF rule; Plesk updates its advisory

Vendor response

Oct 23

PHP issues an informational advisory on a separate session upload progress issue, CVE-2026-115560

Later advisory


PHP 8.6.0 RC4 also contains the fixes, but PHP labels it a test release that must not be used in production.


How the Two Critical PHP2Shell Vulnerabilities Work


CVE-2026-109618: Out-of-Memory Corruption


PHP enforces memory_limit by calling longjmp(), a C routine that jumps out of the current execution context so a request can be aborted. The advisory explains that in some contexts request memory is reachable before it is fully initialized. If any allocation fails at that point, the early exit leaves the request in an invalid state, and the failed allocation does not need to be related to the damaged memory. Request shutdown then reads or branches on it.


Three multipart parsing behaviors can push a request to that failure while it still looks small. A multipart body without a usable declared length can pass the initial post_max_size check and keep supplying decoded data. A part can carry unlimited headers that cost far more memory inside PHP than on the wire. Empty file fields escape the max_file_uploads count yet still create metadata arrays, and nested field names multiply the work.


Apache mod_php always runs the shutdown procedure, even when request startup failed, and automatic body parsing happens during startup. That is why the demonstrated attack needs no application code. PHP-FPM exits the child when startup fails, which closes that route, but later out-of-memory paths remain, so source analysis supports FPM as susceptible even though no complete FPM exploit was demonstrated for this CVE. FrankenPHP calls shutdown unconditionally and is likely susceptible to the application-independent attack, while LSAPI models FPM, with application-specific exploits likely but unvalidated. The fix removes longjmp() for out-of-memory events and uses a soft stop at the next safe point, plus an immediate hard stop through _exit() at a higher second threshold.


CVE-2026-109619: Stale Global State


A PHP worker is a long-lived process that serves many requests and keeps some global state between them. The advisory describes error, session, object and extension state that points into memory owned by one request and must be reset before that memory is released. A fatal error, including one caused by memory exhaustion, can abandon an operation before the reset runs, and a later warning can repopulate the state after cleanup. The heap is freed while the global still points into it. That is a use-after-free: later code uses memory that no longer belongs to it.


Exploitation needs a producer, an operation that stores request-owned state somewhere reachable, and a consumer, a later operation that acts on it before normal initialization. Both must reach the same worker, and the demonstrated cases span separate HTTP requests. Two consumers are confirmed. One is INI diagnostics raised before request initialization, for example from deprecated or invalid per-request settings, which in mod_php can come from .htaccess and php_value directives and in FPM from PHP_VALUE parameters sent by a frontend. The other is session upload progress, which can reach session handling before ordinary initialization. On PHP 8.5, fatal error backtraces are a confirmed producer. The advisory validates RCE for the backtrace path on mod_php and for the session path on both mod_php and PHP-FPM, with FPM needing a suitable application operation.


Side-by-Side Comparison


Aspect

CVE-2026-109618

CVE-2026-109619

Short name

OOM corruption

Stale global state

Core failure

Early exit leaves request memory invalid

Request-owned state outlives its memory

Typical trigger

Memory exhaustion, often via crafted multipart input

Fatal error or diagnostic, then a later request on the same worker

Same worker needed

No

Yes

Confirmed RCE

Unauthenticated, mod_php, default limits

mod_php (backtrace and session paths); PHP-FPM (session path)

PHP-FPM

Susceptible; no complete exploit demonstrated

RCE validated through session lifecycle

FrankenPHP and LSAPI

FrankenPHP likely susceptible; LSAPI likely but unvalidated

No early INI consumer established in FrankenPHP defaults; LSAPI conditional

Partial mitigations

memory_limit=-1, input limits

session.upload_progress.enabled=0; fatal_error_backtraces=0 on PHP 8.5

Complete fix

Patched PHP

Patched PHP


Labeling differs between sources. The Wiz write-up lists an upload-progress use-after-free and a memory-disclosure bug under CVE-2026-109618, while PHP's advisories place the session upload progress lifecycle under CVE-2026-109619. Wiz also says other variants exist and fold under the same two identifiers. For defenders the difference is academic: both CVEs are fixed by the same releases, and neither is covered by a complete configuration workaround.


How PHP2Shell Causes Remote Code Execution or Memory Disclosure


An exploit in this class follows a pattern that can be described without any technique:


  1. A web request reaches PHP, usually on a public endpoint, with no login required.

  2. The input drives PHP into memory exhaustion or a fatal error at an unsafe moment.

  3. Internal state is left invalid or stale.

  4. Shutdown or a later request on the same worker uses that state.

  5. Attacker-influenced data occupies the reclaimed memory, which can turn the misuse into code execution or a memory read.


PHP states that reliability depends on the PHP build, extensions, frontend behavior and allocator layout, and that extra workers and unrelated traffic raise the number of attempts without removing the condition.


Code runs as the web worker account, not as root. That is still enough to read application source, configuration files, database credentials and tokens, change content, plant web shells (a form of malware), and probe internal networks. Researchers also demonstrated remote process-memory disclosure, which can expose passwords, tokens and keys belonging to other requests with no code execution. Because no malicious code runs, it may be harder to spot.


Three kinds of evidence must stay separate: lab demonstrations (Wiz showed pre-authentication RCE against current WordPress, Drupal and Joomla container images), observed attack attempts in telemetry, and independently confirmed production compromises. Each later section labels which one it is describing.


Affected PHP Versions and Fixed Releases


Branch

Vulnerable upstream releases

First fixed upstream

Upstream support, per php.net

Action

8.5

Below 8.5.12

8.5.12

Security support to Dec 31, 2029

Update now

8.4

Below 8.4.27

8.4.27

Security support to Dec 31, 2028

Update now

8.3

Below 8.3.36

8.3.36

Security support to Dec 31, 2027

Update now

8.2

Below 8.2.35

8.2.35

Security support ends Dec 31, 2026

Update, then plan migration

8.1 and older

All upstream releases

None; PHP published source-only backport branches for 7.4, 8.0 and 8.1

End of life

Vendor backport or migrate


Later releases on each branch also qualify. These are upstream thresholds, not a universal test. Linux distributions and long-term support vendors received the patches in advance and often backport fixes without changing the main version number. In a vendor snapshot from October 21, the fixed Ubuntu 24.04 package still carried a PHP 8.3.6 base version, and Plesk states that its end-of-life builds of 7.4.33, 8.0.30 and 8.1.34 keep the same number and are fixed only when built on October 21, 2026.


"Patched" therefore means one of two things: an upstream version at or above the fixed release, or a vendor build whose changelog or advisory names both CVEs, with every worker restarted afterward. CERT-EU also noted that the volunteer-run Remi repository would not have updates on release day, so repository choice matters. After upgrading, review application behavior: PHP's guidance and the researchers note that the new hard memory limit ends the process without running shutdown handlers. PHP 8.2 loses upstream security support on December 31, 2026.


Who Is at Risk: Apache, PHP-FPM, Hosting, WordPress, and Other Applications


PHP's advisory says all installations serving web requests are at risk, with the highest risk on mod_php. "At risk" is not the same as "equally exploitable," so the table separates runtime exposure, demonstrated paths and dependencies.


Stack

Underlying exposure

Demonstrated path

Depends on

Patch owner and priority

Apache mod_php

Susceptible to both CVEs

Unauthenticated RCE before application code (CVE-2026-109618); backtrace and session paths (CVE-2026-109619)

Build, extensions, frontend, allocator layout

Server owner or host; highest

PHP-FPM behind Nginx or Apache

Susceptible; failed startup removes the child

Session-lifecycle RCE (CVE-2026-109619); no complete CVE-2026-109618 exploit shown

Suitable application operation, frontend PHP_VALUE use, pool settings

Server owner or host; high

php-cgi

Named by PHP as at risk

Not separately analyzed in the advisories

Deployment model

Owner; high until verified

LiteSpeed and LSAPI

Named as at risk; models FPM

Application-specific exploits likely but unvalidated

Environment INI values, application

Owner or host; high

FrankenPHP

Named as at risk; shutdown always runs

Likely susceptible by source analysis, not validated

Extensions, application

Owner; high

Containers and Kubernetes

Inherit the runtime in the image

Same as the server type inside

Base image age, rebuild pipeline

Image owner rebuilds and redeploys every replica


Applications inherit the risk without causing it. Wiz demonstrated pre-authentication RCE against WordPress, Drupal and Joomla images, but exploitation does not require them, and Laravel, Symfony, MediaWiki and custom code sit on the same runtime. Application behavior still matters for CVE-2026-109619, because fatal errors, plugin callbacks and upload handlers can supply producers or consumers. A site built on a hosted website builder is not shown to run a vulnerable PHP backend by that fact alone; ask the vendor.


Who patches what depends on the model:


  • Your own server or VM: you, through the operating system or panel.

  • Shared and managed hosting: the provider patches the shared runtime; you confirm in writing.

  • Containers: you rebuild images from patched bases, so a running Docker image or Kubernetes workload stays vulnerable until redeployed. See also how containerization changes patch ownership.

  • Appliances and bundled products: the vendor; the NCSC-NL repository lists software with a PHP dependency.

  • Control panels: administrators, including Plesk, whose own panel engine needs a separate update.


How to Check Whether a PHP Server Is Vulnerable


Only inspect systems you administer or are authorized to assess. The command-line version from php -v is a first clue at best, because the CLI binary can differ from the one serving web traffic, a host can have several PHP builds, and vendor backports hide the fix behind an unchanged version number.


  • List every runtime: web servers, FPM pools, containers, images, panels and bundled products.

  • Identify the web-serving binary and server API from the running process, not from the shell.

  • Compare upstream versions with the fixed releases, and for vendor builds read the changelog or advisory.

  • Confirm that workers were restarted after the update.

  • Do not leave a phpinfo page exposed; it reveals version, server API and settings to attackers.

  • For managed hosting, ask for written confirmation of the build and restart.


# Running PHP-related processes (Linux, read-only)
ps -eo pid,user,args | grep -E 'php-fpm|apache2|httpd|lsphp|frankenphp' | grep -v grep

# Binary behind a running process (replace PID)
ls -l /proc/PID/exe

# Apache modules (Debian/Ubuntu naming; use httpd -M on RHEL-family)
apache2ctl -M 2>/dev/null | grep -i php

# FPM version (binary name varies, for example php-fpm8.3 on Debian/Ubuntu)
php-fpm8.3 -v

# Fix recorded in the package changelog (Debian/Ubuntu example; adjust package name)
zgrep -E "CVE-2026-10961[89]" /usr/share/doc/php8.3-common/changelog.Debian.gz

# RHEL-family equivalent
rpm -q --changelog php-common | grep -E "CVE-2026-10961[89]"

# Images used by running Kubernetes pods (read-only)
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.spec.containers[*].image}{"\n"}{end}'

Use the following decision table to classify each system:


Status

How to classify

Next action

Patched

Upstream version at or above the fix, or vendor evidence names both CVEs, and workers restarted

Record the evidence; keep monitoring

Vulnerable

Upstream version below the fix with no backport evidence

Patch or isolate now

Potentially affected

Package updated but restart unconfirmed, several builds present, bundled runtime or unknown image age

Verify the running process and image

Vendor verification required

Appliance, panel, managed host or end-of-life branch on a vendor build

Get written confirmation of the fixed build


Is PHP2Shell Being Exploited in the Wild?


Attempts have been reported. Whether they succeeded is a separate question, and the sources reviewed do not answer it.


Evidence level

What it shows

Reported so far

Limits

Lab demonstration

A working exploit in a controlled setting

Wiz: pre-authentication RCE on WordPress, Drupal and Joomla images and memory disclosure; PHP: mod_php RCE validated with default limits

Not evidence of attacks

Observed attempt

Exploit-like requests in telemetry

AWS: one attempt on Oct 17, more on Oct 21 between 02:00 and 08:00 UTC, then broad attempts after release; Cloudflare: attack traffic against customers and mutating payloads

AWS says it is unclear whether attempts would have succeeded in real systems

Confirmed production compromise

Independent confirmation of a successful intrusion

None attributed in the sources reviewed

Absence of reports is not proof of absence


Government assessments point the same way. NHS England assesses future exploitation as highly likely, and CERT-EU warned that circulating proofs of concept raise the likelihood that exploitation is already happening. AWS advises starting investigations from October 17 rather than the disclosure date, and measuring patch timelines in hours. Both AWS and Wiz argue that AI-assisted analysis is shortening the time from patch to working exploit, a trend also covered in our guide to AI in cybersecurity. Elastic notes that detection can rely on post-exploitation behavior rather than a public exploit.


As of October 24, 2026, no listing of either CVE in CISA's Known Exploited Vulnerabilities catalog could be confirmed, and a Tanium timeline recorded neither CVE listed on October 21. Check the catalog directly before relying on its status. Early summaries stating that no exploitation had been seen reflect timing; later accounts describe attempts.


PHP2Shell Detection: Logs, Behaviors, and Indicators of Compromise


Attempt Versus Compromise


Detection has two goals. The first is spotting exploit attempts, which are common and mostly harmless on patched systems. The second is spotting compromise, which needs evidence of what ran afterward. Wiz notes that application logs may hold little context because the flaws act below the application layer, and memory disclosure leaves quieter traces than code execution. Indicators such as shared-infrastructure IP addresses can go stale, so AWS advises investigating observations rather than blocking on them.


Signal

Where to look

Interpretation

Limits and false positives

Triage action

Multipart POSTs carrying the PHP_SESSION_UPLOAD_PROGRESS field

WAF, proxy or full-body logs

The session path AWS tells defenders to hunt

Legitimate progress tracking; invisible if bodies are not logged

Review client, path and surrounding requests

Multipart requests followed by memory-limit errors or repeated HTTP 500

Web and proxy logs, PHP error log

Pattern listed by Wiz

Large legitimate uploads and imports

Correlate by client and time; compare to baseline

Fatal errors, timeouts or parse errors on reachable routes

PHP error log

Possible producers for CVE-2026-109619

Common application bugs; log level may hide some

Fix reachable fatals; note timing

Worker crashes or signal exits

Apache or FPM logs, system journal

Memory corruption can crash workers

Bad extensions, kernel OOM killer

Capture details; check requests at crash time

Oversized or malformed PHPSESSID in responses

Proxy or CDN response logs

Possible memory-disclosure sign per Wiz

Rarely logged; custom session handlers

Pull the full transaction; assume exposure possible

Web server or PHP worker spawning shells or tools

EDR, auditd, process telemetry

Common post-exploitation outcome per Elastic

Some apps shell out legitimately

Isolate if unexplained; preserve volatile data

New or changed script files in web or upload paths

File integrity monitoring, EDR

Possible web shell

Deployments and plugin updates

Compare to release records; hash and quarantine

Unusual outbound connections from web servers

Flow logs, firewall, DNS

Payload fetch, reverse shell or exfiltration

API and CDN calls

Compare against an egress allowlist

Credential use outside normal patterns

Cloud audit, database and identity logs

Secrets taken from memory or files

Travel, VPN

Rotate affected secrets; review sessions


Correlation Ideas


  • Join multipart POSTs, error-log entries, worker restarts and child processes on one timeline per host.

  • Hunt across hosts for one client touching many PHP servers, starting at October 17.

  • Feed web-server process telemetry into a SIEM and threat detection and response workflow, and use anomaly detection against a per-host baseline.

  • Protect hosts with endpoint protection that records process and file events.


Safe Log Checks


# Errors worth reviewing (read-only; adjust log paths)
grep -E "Allowed memory size|Maximum execution time|Fatal error|exit signal|exited on signal" /var/log/apache2/error.log /var/log/php*-fpm.log

# Script files changed in the last seven days (example web root)
find /var/www -type f \( -name "*.php" -o -name "*.phtml" \) -mtime -7 -ls

Absence of indicators is not proof of safety. PHP's own advisory warns that these paths may leave no predictable log entry, that historical logs may exclude relevant severities, and that a failure can occur before PHP writes a message. Treat logs as supporting evidence.


How to Patch PHP2Shell Safely: Step-by-Step Playbook


  1. Inventory and assign owners. Record every runtime, who owns it and how it is deployed.

  2. Prioritize. Internet-facing mod_php and FPM systems come first, then anything handling sensitive data.

  3. Select fixed packages. Prefer your distribution's or vendor's fixed build, and confirm by changelog or advisory.

  4. Back up and prepare rollback. Save configuration, pool files and the previous package version.

  5. Test compatibility. Check extensions, upload behavior and the new hard memory limit on a staging copy.

  6. Apply the update. Use your normal change process; do not mix repositories casually.

  7. Rebuild containers. Patch the base image, rebuild, and redeploy every replica.

  8. Restart or recycle every worker. Apache, FPM and any long-running PHP process.

  9. Verify the running runtime. Check process start times and the binary in use.

  10. Smoke-test. Exercise logins, forms and uploads.

  11. Recheck telemetry. Review logs for attempts and earlier compromise.

  12. Document status and exceptions. Record evidence, owners and deadlines for anything unpatched.


Update paths differ. An operating-system package update changes the host runtime. A container needs a new image. A managed host changes the runtime on its side, and a hosting panel may select PHP per site. Each leaves different proof, so collect the right one.


# Example: Debian/Ubuntu with PHP 8.3 packages (names vary). Review pending updates:
apt list --upgradable 2>/dev/null | grep -i php

# After your standard update, restart services (example unit names):
sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2

# Confirm processes started after the update and which binary they use:
ps -eo pid,lstart,args | grep -E 'php-fpm|apache2' | grep -v grep

Plesk Considerations


Plesk's advisory covers two layers. PHP versions shipped with Plesk are fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and end-of-life builds are fixed when built on October 21, 2026. The PHP engine used by Plesk itself is fixed in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11. Update Plesk, then check the "built" date in the version output, for example from /opt/plesk/php/8.3/bin/php -v on Plesk for Linux. Disciplined configuration management makes this repeatable.


Temporary PHP2Shell Mitigations When Patching Is Delayed


Every measure here reduces exposure to a specific path and leaves residual risk. PHP states plainly that only an update is complete. NHS England and CERT-EU go further: where patching is impossible, assess risk and consider taking affected systems offline or isolating them from public networks.


Measure

Confirmed path affected

Trade-off

Why it is not a full fix

Restrict public access (VPN, allowlist, offline)

All network paths

Availability loss

Works only while in place

Edge WAF rules and body-size caps

Request patterns for CVE-2026-109619; oversize bodies for CVE-2026-109618

False positives; limited body inspection (8 KB on ALB, 16 to 64 KB elsewhere, per AWS)

Cannot see inside multipart parts or server-side paths

Block multipart/form-data where uploads are unused

Multipart memory path; session-upload trigger

Breaks uploads

Other triggers remain

session.upload_progress.enabled=0, then restart workers

Confirmed session paths (CVE-2026-109619)

Removes upload progress tracking

Other lifecycle variants remain

fatal_error_backtraces=0 (PHP 8.5)

Confirmed backtrace producer

Less crash detail

Covers that path only

memory_limit=-1, enforced administratively

Controllable memory-limit failure (CVE-2026-109618)

Removes the per-request ceiling; raises resource-exhaustion risk

Underlying allocation failure still reaches the path; no effect on CVE-2026-109619

Low post_max_size and proxy limits on size, fields, parts, headers, nesting

Multipart memory pressure

Breaks large legitimate uploads

Reduces, does not remove

pm.max_requests=1 worker recycling

Producer and consumer sharing a worker

Large performance cost

Only lowers opportunities

Remove reachable fatals and per-request INI diagnostics

Producers and consumers for CVE-2026-109619

Engineering effort

Hiding errors does not help; no errors is not proof


Apply settings through php.ini, an FPM pool or server configuration that takes effect before request parsing, not ini_set() or .user.ini, and restart every worker. PHP's contextual guidance for post_max_size is 8M without uploads and 32M with them; these are examples, not universal safe values. A container or cgroup memory limit can act as an availability boundary, ideally killing only the affected worker, but never substitute RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable failure. Keep monitoring while exposed, and set a short deadline for the real patch.


What to Do If You Suspect a PHP2Shell Compromise


Patching stops new attacks, but it does not remove an attacker who already has persistence.


  1. Triage. Define what was seen, when, and on which hosts, starting from October 17.

  2. Contain. Isolate affected hosts or block egress, balancing evidence preservation against spread.

  3. Preserve evidence. Capture process lists, network connections and memory where practical, then web, application, endpoint and network logs.

  4. Scope. Identify every host sharing configuration, credentials or network reachability.

  5. Investigate. Examine PHP and child processes, new or modified files, cron jobs, services, SSH keys and web shells.

  6. Assume secrets are exposed. Rotate database, application, cloud and API credentials the worker could read, and invalidate sessions.

  7. Check lateral movement and exfiltration. Review identity, database and cloud audit logs, and outbound traffic.

  8. Rebuild. Restore from trusted images or known-good backups on patched PHP rather than cleaning in place where compromise is confirmed.

  9. Validate. Verify patch level, configuration and monitoring before returning to service.

  10. Review obligations and lessons. Check contractual and legal notification duties with qualified advisers, then record what to change.


Long-Term PHP Server Hardening


Patching fixes this vulnerability. These practices reduce the impact of the next one:


  • Keep a centralized inventory of runtimes, images and owners, and track end-of-life dates such as PHP 8.2 on December 31, 2026.

  • Set vulnerability service levels for internet-facing critical flaws in hours or days, not weeks, as AWS recommends.

  • Run workers with least privilege on hardened Linux hosts, with separate pools per site.

  • Keep secrets out of web-readable files and use short-lived credentials.

  • Restrict outbound traffic from web servers and segment the network, following network security practice.

  • Centralize logs and run EDR on web hosts.

  • Rebuild immutable workloads from maintained images using infrastructure as code and automated DevOps pipelines, and secure them with cloud-native security controls.

  • Test restores through backup as a service or disaster recovery exercises.

  • Budget for upkeep; the cost of software maintenance is lower than emergency migration.

  • Foundational context is in our guides to cybersecurity and cloud security.


Choosing a WAF, Scanner, Managed Host, MDR, or Incident-Response Provider


No product removes these vulnerabilities, and none should be sold as doing so. Use this comparison to see what each category contributes.


Category

Can help with

Cannot do for these CVEs

Ask the vendor

WAF or CDN

Rules for known request patterns, size limits, rate limits

See server-side paths or multipart internals; replace patching

Which rules map to which CVE, update speed, false-positive handling

Vulnerability scanner or cloud posture tool

Find PHP versions, images and exposure

Prove backport status or absence of compromise

How it reads package metadata and bundled runtimes

EDR or XDR

Detect shells, child processes and file drops

Prevent the memory flaw itself

Linux web-server rule coverage and response actions

SIEM or MDR

Correlate logs, hunt, triage

Detect events that were never logged

Log sources needed, response time commitments

Managed hosting

Patch shared runtimes and restart

Know your application's own risks

Written fix and restart confirmation, timing, shared responsibility

Incident response

Scope, contain and rebuild after compromise

Undo missed exposure

Availability, forensic scope, evidence handling


Procurement priorities: demand written patch confirmation, response-time commitments, clear data and log access, and a defined split of duties. Weigh whether to build in-house or use outsourced expertise, and align governance with cloud governance and compliance duties. For overlapping controls see firewall fundamentals and data loss prevention. No prices, rankings or guarantees appear here because none can be verified.


PHP2Shell Myths and Misconceptions


Claim

Reality

Updating WordPress fixes it

The flaws are in the PHP runtime, so only a patched PHP fixes them

A WAF fixes it

A WAF reduces exposure on some paths but is not a fix

One version string proves safety

php -v can describe the wrong binary, and vendors backport

Only mod_php is affected

PHP-FPM, FrankenPHP and others are exposed through other paths

All server types face identical conditions

Confirmed paths and prerequisites differ

No logs means no attack

PHP says these paths may leave no predictable log entry

Patched means never compromised

Attacks began before disclosure, and patching does not remove persistence

Every probe is a successful exploit

Most observed traffic is attempts, not confirmed compromise


PHP2Shell Emergency Administrator Checklist


Copy this into a ticket. Each item is done only when its evidence exists.


  • Within 24 hours: Inventory all PHP runtimes (done when every host and image has an owner). Patch internet-facing systems or isolate them (done when version or vendor evidence is recorded). Restart all workers (done when process start times follow the update).

  • Within 72 hours: Cover remaining systems and rebuild images (done when no unpatched replica runs). Review logs from October 17 onward (done when findings are documented). Apply partial mitigations to anything still waiting (done when each has a deadline).

  • Within one week: Confirm managed hosts and appliances in writing (done when confirmations are filed). Rotate secrets for any suspected host (done when old credentials are revoked). Update monitoring and patch service levels (done when changes are approved).


FAQ


What is PHP2Shell in simple terms?


It is the nickname for two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619. Because the bugs sit below your application, a site can be exposed even when its own code is clean. PHP fixed both on October 21, 2026, and only a patched PHP build fully removes them.


Is PHP2Shell being exploited in the wild?


Attack attempts have been reported. AWS saw an attempt on October 17, 2026 and more after disclosure, and Cloudflare saw attack traffic. Those are attempts, and the sources reviewed do not confirm widespread successful compromise. Treat exposed servers as targets and investigate from October 17.


Can attackers exploit PHP2Shell without authentication?


Yes, the advisories rate both flaws as needing no privileges or user interaction, and unauthenticated RCE is confirmed for Apache mod_php. Success still depends on server type, PHP build, configuration and application conditions, so a high score is not a guarantee for every site.


Which PHP versions fix PHP2Shell?


PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026, are the first fixed upstream versions, and later releases also qualify. Vendor packages may carry the fix under older version numbers, so confirm by changelog or advisory rather than the version string alone.


Is PHP 8.1 or older safe?


No upstream fix ships for 8.1 and earlier, which are end-of-life. PHP released source-only backport branches for 7.4, 8.0 and 8.1, and some distributions and vendors supply patched builds. Verify the build with your vendor or migrate to a supported branch.


Does updating WordPress fix PHP2Shell?


No. WordPress, Drupal and Joomla updates change application code, while these flaws are in the PHP runtime beneath them. Update PHP, or ask your host to, and restart workers.


Does PHP-FPM face the same risk as Apache mod_php?


Not identically. mod_php has the confirmed application-independent path for CVE-2026-109618. FPM is still susceptible and has validated RCE for CVE-2026-109619 through session upload progress, though that needs a suitable application operation. Both need patching.


Can a WAF stop PHP2Shell?


A WAF can reduce exposure, and AWS and Cloudflare shipped rules, but none is a fix. WAFs see only part of a request, can be evaded and cannot see server-side paths. Use one while you patch, then keep it as an extra layer.


How do I check whether my server is patched?


Find the web-serving binary, not just the CLI. Compare its version with the fixed releases or check the package changelog for both CVE numbers, confirm the build date for vendor builds, and verify that workers restarted. Containers need a rebuilt image.


Is memory_limit=-1 a safe fix?


No. PHP describes it as a temporary measure for CVE-2026-109618 only. It removes a normal safeguard, can raise resource-exhaustion risk, and an underlying allocation failure can still reach the vulnerable path. Pair it with container or cgroup limits and patch quickly.


Do I need to restart PHP after patching?


Yes. Long-lived workers keep running old code until restarted. Restart Apache, PHP-FPM and any other PHP service, then confirm process start times and binaries. A package update on disk alone does not protect running workers.


How can I tell whether someone attempted or achieved exploitation?


Look for multipart POSTs, memory-limit errors, repeated HTTP 500 responses, worker crashes, odd PHPSESSID cookies, new script files, web-server child processes and unusual outbound traffic. Attempts and compromise differ, and missing indicators are not proof of safety.


Do managed hosting customers need to act?


Yes, to confirm. Ask the provider in writing which PHP builds serve your site, whether both CVEs are fixed and whether workers were restarted. If you run your own container or VPS, you patch it yourself.


What is the October 23 session upload progress advisory?


PHP's informational advisory references CVE-2026-115560, a separate issue needing an unusual setup: an application sets session.serialize_handler to php_binary or php_serialize, then switches to php at runtime before session_start(). PHP suggests keeping session.upload_progress.enabled=0 until the next regular release, which will carry a full advisory. The October 21 builds are not stated to fix it.


When should I hire incident-response or managed security help?


Consider it if you cannot inventory PHP runtimes, cannot patch within days, lack logging or EDR, hold regulated data, or see unexplained shells, new files or outbound traffic. Patching alone does not evict an established attacker.


Key Takeaways


  • PHP2Shell is two Critical (CVSS v4.0 9.2) flaws in core PHP: CVE-2026-109618 and CVE-2026-109619.

  • The fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published October 21, 2026.

  • A patched runtime, upstream or vendor-backported, is the only complete remediation; every worker must be restarted.

  • Apache mod_php has the confirmed unauthenticated pre-application path; FPM, FrankenPHP and LSAPI have different, narrower or unvalidated paths.

  • CMS and plugin updates do not patch PHP.

  • Attempts were observed from October 17, but confirmed production compromise is not established in the sources reviewed.

  • Mitigations such as disabling session upload progress or memory_limit=-1 are partial and carry trade-offs.

  • Absence of indicators is not proof of safety, and patching does not remove prior compromise.


Actionable Next Steps


  1. Within hours, list every PHP runtime and assign an owner to each.

  2. Patch or isolate internet-facing mod_php and FPM systems first, and record the evidence.

  3. Restart all workers and verify process start times.

  4. Rebuild and redeploy container images from patched bases.

  5. Request written fix and restart confirmation from every host and vendor.

  6. Within 48 hours, review logs and EDR from October 17 onward.

  7. Apply documented partial mitigations to anything still waiting, with a deadline.

  8. If anything suspicious appears, contain, preserve evidence and rotate secrets.

  9. Within a month, migrate or extend support for 8.1 and older, and plan for PHP 8.2 ending on December 31, 2026.

  10. Ongoing, set hour-level patch targets for critical internet-facing flaws and test them.


Glossary


  • PHP2Shell: The name for two critical core-PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

  • CVE: A Common Vulnerabilities and Exposures identifier for a disclosed flaw.

  • CVSS: The Common Vulnerability Scoring System, a severity rating that is not proof of exploitability.

  • RCE: Remote code execution, running attacker-chosen code on a target.

  • OOM: Out of memory, a failure when a process cannot get more memory.

  • longjmp: A C routine that jumps out of the current execution context.

  • Memory corruption: Unintended changes to memory contents that alter program behavior.

  • UAF: Use-after-free, using memory after it has been released.

  • SAPI: Server API, the way PHP connects to a web server.

  • mod_php: The Apache module that runs PHP inside the web server process.

  • PHP-FPM: FastCGI Process Manager, a pool of separate PHP worker processes.

  • LSAPI: LiteSpeed's interface for running PHP.

  • PHP worker: A long-lived process that serves many requests.

  • Memory disclosure: Reading memory an attacker should not see.

  • Backport: A fix applied to an older version without changing its main version number.

  • WAF: Web application firewall, which filters HTTP traffic.

  • IOC: Indicator of compromise, an observable that may suggest intrusion.

  • EDR: Endpoint detection and response, host-level monitoring and response.

  • SIEM: Security information and event management, centralized log analysis.

  • Incident containment: Actions that stop an incident from spreading while preserving evidence.


Sources & References


bottom of page