php2shell: two critical PHP vulnerabilities, what to do

Article

Cybersecurity

CISO-as-a-service consulting: posture, remediation roadmap, ongoing support.

Discover →

CyberAgent

Continuous vulnerability assessment and gap analysis: scanning, mapping onto framework requirements, documentary evidence ready to use.

Discover CyberAgent →

On 21 October the PHP security team published versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing CVE-2026-109618 and CVE-2026-109619. According to the advisory both allow unauthenticated remote code execution and score 9.2 on CVSS v4.0. The researchers who found them call them php2shell.

The advisory covers all installations serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is considered highest for mod_php, where an exploit has been demonstrated that starts with an unauthenticated request before any application code runs.

The two vulnerabilities

• CVE-2026-109618, corruption on memory exhaustion. When memory runs out, PHP can be interrupted while internal request data is only partially initialised; the subsequent cleanup may treat that invalid data as valid.
• CVE-2026-109619, stale global state. Request-owned internal state can survive after its backing memory has been freed (use-after-free); a later request handled by the same worker may use it before normal initialisation resets it.

According to the Calif researchers’ write-up, the chain uses crafted multipart requests to exhaust the memory limit and leave inconsistent state, which the next request consumes through session upload progress or deserialisation. Calif reports confirming pre-authentication code execution on specific versions of widely used applications, including WordPress, Drupal, Joomla, Magento, Nextcloud and phpMyAdmin, and that the earliest vulnerable path it found dates back to PHP 5.4.0. These are the researchers’ own findings, not yet independently verified.

Versions to install

Linux distributions and extended-support vendors received the patches in advance: anyone using distribution packages should check their vendor’s updates. The volunteer-run rpms.remirepo.net repository will not have updates on release day. CERT-EU points out that third-party products embedding PHP may also be affected, and refers to the list maintained by the Dutch NCSC, which is still incomplete.

Exploitation reports

The information available is still preliminary.

• Amazon Threat Intelligence reports observing an exploitation attempt on 17 October in its MadPot honeypot network, four days before disclosure, and further attempts on 21 October from different infrastructure, with payloads suggesting several actors. Amazon says it is unclear how the attacker obtained the information and whether the attempts would have succeeded against real systems, and writes that php2shell is now being broadly exploited.
• Cloudflare: on 21 October CTO Dane Knecht wrote that the company is seeing early attacks and has deployed WAF rules for the known vectors, available on free plans too; the rules only cover traffic routed through its network, and he himself calls them a stopgap.
• The PHP security team inspected the proofs of concept that appeared after the leak and, at release time, found no functional exploits. Unverified code in circulation may contain malware.

What to do now

1. Inventory. Identify every exposed PHP installation, including those inside third-party products, containers and base images.

2. Update. Install the fixed versions or the updated distribution packages, rebuild container images and restart every PHP worker. According to the PHP team, updating is the only complete fix.

3. If you cannot update immediately, the mitigations in the advisory reduce exposure but do not make an installation safe:

   • memory_limit=-1 set so that applications cannot override it (for example php_admin_value in the FPM pool), with a low post_max_size (8M without uploads, 32M with uploads) and limits on request size and structure at the web server or proxy;
   • session.upload_progress.enabled=0 in php.ini or the FPM pool, not via ini_set() or .user.ini;
   • on PHP 8.5, fatal_error_backtraces=0;
   • fix fatal errors and timeouts an attacker can reach, and remove invalid per-request settings;
   • restart every worker after each change.

   CERT-EU suggests considering isolating exposed applications from the public network until the fix is applied and verified.

4. Check. Amazon recommends reviewing logs from at least 17 October, looking for POST requests containing the string PHP_SESSION_UPLOAD_PROGRESS, and checking for unexpected process execution and file changes on web servers.

For NIS2 entities, if the checks find a compromise with significant impact, incident notification obligations apply, starting with the early warning within 24 hours.

How the release came about

From the PHP Foundation’s account: the first signs of the memory problem surfaced in Quarkslab’s 2024 audit; Calif reported remote code execution on 11 August 2026, the same day as OpenAI, followed by Wiz’s report (24 August) and further vectors from OpenAI (18 September). On 20 October the CVE identifiers started circulating with a wrong time and a wrong score (10.0 instead of 9.2), and the release was brought forward from 22 to 21 October; on the morning of the 21st a distributor published images containing the fix more than six hours before the coordinated release.

AI tools played a part in discovery and handling: Calif describes using an LLM assistant and audit agents, OpenAI took part with Codex Security, and the PHP team uses AI to validate reports and group those with the same root cause, while decisions and patches remain with people.

What we think

PHP serves a very large share of the web, often in forgotten installations: institutional sites, management software, plugins, appliances with embedded PHP. So the first difficulty is not applying the patch but knowing where it is needed. The case confirms how much the time between discovery and exploitation is shrinking, with AI helping on both sides, as we wrote about REA: for critical internet-facing vulnerabilities, Amazon urges thinking in hours rather than days. An up-to-date inventory of exposed components and a fast update procedure matter more than any WAF rule, which remains a temporary measure.

What to watch

• Whether the two CVEs are added to CISA’s KEV catalogue and confirmations of real compromises.
• The researchers’ full technical analysis and any new vectors.
• Distribution packages for out-of-support branches and the list of affected third-party products.

Sources

• PHP, Security advisory: critical remote code execution vulnerabilities, update now
• GitHub Security Advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• GitHub Security Advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• The PHP Foundation, Today’s PHP security release
• CERT-EU, Security Advisory 2026-018
• Amazon Threat Intelligence, php2shell exploitation prior to public disclosure
• Calif, php2shell
• Dane Knecht (Cloudflare CTO), post on X, 21 October 2026
• NCSC-NL, php2shell (affected products, detection and mitigations)
• REA: reverse engineering with AI agents over MCP