PHP2Shell: Critical PHP RCE Flaws — Patch Now

The PHP project shipped emergency security releases on October 21, 2026 — PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — to close two critical, unauthenticated remote-code-execution vulnerabilities nicknamed "PHP2Shell." The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 base score of 9.2 and affect essentially every PHP installation that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an alert the same day urging organizations to patch immediately. If you run PHP anywhere in your stack, this is a drop-everything update.

What is PHP2Shell?

"PHP2Shell" is the informal name attached to a pair of vulnerabilities in PHP's core request-handling code. According to the PHP project's own security advisory, both bugs can let an attacker who sends nothing more than an ordinary, unauthenticated HTTP request achieve remote code execution on the server — no login, no malicious plugin, and no vulnerable application code required. The project's security announcement frames the risk plainly: "All PHP users are strongly encouraged to update immediately."

The nickname and the leak around it created some of the urgency here. Several vendor write-ups report that technical details circulated ahead of the originally planned coordinated-disclosure date, pushing the PHP security team to ship patches for four branches at once, on short notice, rather than wait.

The two vulnerabilities, explained

Both bugs are rooted in how PHP cleans up after a request that doesn't finish normally — an out-of-memory condition, a fatal error, or a worker reused for the next request before everything resets.

CVE-2026-109618 — RCE via OOM corruption (GHSA-w8hw-w9fx-j79w): PHP uses longjmp() to bail out of an out-of-memory error. If that OOM hits while request memory is only partially initialized, shutdown code can end up treating invalid, half-built state as valid. The advisory says it validated this against mod_php running with default settings. The fix replaces the longjmp() bailout with a "soft" OOM that waits for the next safe point in the Zend VM, plus a "hard" OOM that terminates the process outright via _exit() rather than trying to clean up unsafe state.

CVE-2026-109619 — RCE via stale global state (GHSA-6wmf-4rv5-p3rp): PHP workers that handle multiple requests can retain global state — error data, session data, object data, or extension data — that still points at memory from a previous request after that memory has been freed. If something reads that stale pointer before the next request's initialization resets it, you get a classic use-after-free that an attacker can potentially turn into code execution. The PHP project confirmed two concrete triggers: one involving the fatal_error_backtraces setting on PHP 8.5, and one involving session upload-progress handling. An attacker who can get a handful of coordinated requests routed to the same worker may be able to exploit this without authenticating at all.

Both advisories carry the maximum practical severity rating PHP's security team hands out: CVSS v4.0 9.2, vector AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — network-exploitable, no privileges, no user interaction, full compromise of confidentiality, integrity, and availability.

Who is affected

Per the PHP project, the risk applies to "all PHP installations serving web requests" — that's a deliberately broad statement, and it includes:

• PHP-FPM (the FastCGI Process Manager used behind Nginx and many other front-ends)
• Apache with mod_php
• php-cgi
• FrankenPHP (the modern Go-based PHP app server)
• LiteSpeed's PHP integration (LSAPI)

The PHP project specifically calls out mod_php as the highest-risk configuration, noting a demonstrated exploit path where an unauthenticated request triggers the vulnerable code before any application code — your framework, your CMS, your custom logic — ever runs. In other words, this isn't a WordPress bug or a Laravel bug or a Symfony bug; it's underneath all of them. If you can't readily tell whether a server, appliance, or SaaS backend runs PHP, CISA's advice is to inventory first, because PHP is frequently embedded inside other software without being obvious from the outside.

Is this being exploited right now?

This is the part where sources genuinely disagree, and it's worth being precise rather than alarmist. CISA's alert states that, as of its publication, the agency "has not observed exploitation" of CVE-2026-109618 or CVE-2026-109619 — but warns the flaws "pose a risk if left unpatched" and recommends watching for suspicious activity such as PHP worker processes spawning shells or fetching remote tools. Separately, a handful of security vendors have published posts claiming to have detected probing or exploitation attempts in the days since disclosure; those reports are still being independently verified, and as of this writing neither CVE appears in CISA's Known Exploited Vulnerabilities (KEV) catalog. Given the CVSS 9.2 severity, the pre-disclosure leak of technical detail, and the trivial-to-reach attack surface (mod_php can be hit before any app code runs), treat this as a when-not-if situation for unpatched internet-facing servers, regardless of whether exploitation is confirmed yet in your environment. It's a similar calculus to the one behind the recent npm trusted-publishing exposure: patch on the vendor's timeline, not on confirmation of an attack against you specifically.

CISA's alert

CISA published its own advisory, "Critical Vulnerabilities in PHP Require Immediate Patching," on October 21, 2026 — the same day the fixes shipped. The agency's recommended actions are straightforward:

• Inventory every system that runs any version of PHP, including PHP embedded inside other products you didn't build yourself.
• Patch immediately, prioritizing anything internet-facing.
• If you can't update right away, or you're stuck on PHP 8.1 or earlier, take the affected system offline until it's patched or upgraded.
• A web application firewall may reduce exposure in the interim, but it is not a substitute for patching.
• Monitor logs for signs of compromise, such as PHP worker processes launching shells or pulling down additional tooling.

How to patch now

The fix is the same for everyone: get onto a patched point release of your current major/minor branch.

1. Identify your branch and version. Run php -v on affected hosts, or check your hosting control panel. The PHP project's changelog lists exactly what landed in each point release if you want the full diff of fixes beyond the two CVEs.
2. Update to the patched release for your branch — 8.5.12, 8.4.27, 8.3.36, or 8.2.35 — via your OS package manager, container base image, or by building from source downloads on the PHP project's downloads page.
3. If you're on a Linux distribution or managed/LTS vendor (think Debian, Ubuntu, RHEL/Rocky/Alma, or a commercial PHP LTS provider), check for vendor-backported packages first — the PHP project's advisory notes that distributions and LTS vendors received the patches in advance of the public release, so updated packages may already be available through your normal update channel.
4. Restart every PHP-FPM pool, Apache process, or worker after updating — config changes and binary swaps do nothing until workers actually reload the new code.
5. If you're on PHP 8.1 or older, treat this as a forcing function to move to a supported branch (8.2 or newer) rather than hunting for an unofficial patch — see the dedicated section below.

Teams that recently went through a similar fire drill with the GitLab RCE disclosed earlier this year will recognize the playbook: identify affected hosts, patch the ones facing the internet first, then work through the rest of the fleet.

Can't patch immediately? Temporary mitigations

PHP's advisory is explicit that these are stopgaps, not fixes — they reduce exposure but do not make an unpatched installation safe.

For CVE-2026-109618 (OOM corruption):

• Set memory_limit=-1, ideally via php_admin_value in your FPM pool or Apache config, and make sure no other setting re-imposes a finite limit (an underlying allocation failure can still hit the vulnerable path).
• Set a low post_max_size — 8M if you don't need uploads, 32M if you do — and keep upload_max_filesize below it. Consider also capping decoded request size, field count, multipart parts, header count, and nesting depth at your web server or proxy.
• Use a container or cgroup memory limit as a backstop (ideally one that kills only the affected worker). Don't substitute RLIMIT_AS or RLIMIT_DATA — those can themselves trigger the vulnerable allocation-failure path.

For CVE-2026-109619 (stale global state):

• Set session.upload_progress.enabled=0 and restart every worker, applied through php.ini, your FPM pool, or server config — not ini_set() or FPM's .user.ini.
• On PHP 8.5 specifically, set fatal_error_backtraces=0 and restart workers.
• Fix any attacker-reachable fatal errors or execution timeouts in your own code (callbacks, upload handling, import processing, cleanup paths) — suppressing diagnostics with error_reporting, display_errors, or @ does not help, since the underlying state corruption still happens.

These settings only close the specific attack paths PHP's security team has confirmed so far — not every possible variant. Patching remains the only reliable fix.

What about PHP 8.1 and older?

This is the detail that will catch out a lot of legacy sites: PHP 8.1 and earlier branches are already end-of-life and no longer receive official security updates from the PHP project at all, so there is no "8.1.x" patch coming. The project did push minimal, unreleased source backports for PHP 7.4, 8.0, and 8.1 to GitHub branches named PHP-<version>-CVE-2026-109618-109619, but those are intended for teams who build PHP from source themselves, not as an official, supported release. If you're on a packaged build, your options are: check whether your Linux distribution or a commercial PHP long-term-support vendor has backported the fix, or upgrade to PHP 8.2 or newer. CISA's blunter framing: if you can't update immediately and you're running PHP 8.1 or older, take the affected system offline until it's patched or upgraded. PHP 8.2 itself is not a long-term parking spot either — it reaches its own end of life on December 31, 2026, so this is a good moment to plan a move to 8.3 or later rather than just the minimum patch.

What's next

The story isn't fully closed. The PHP project's own announcement references a related, still-developing issue: a follow-up informational advisory about a session upload-progress problem, tracked separately as CVE-2026-115560, with the project saying a full advisory is planned alongside its next release. Expect further guidance — and possibly another patch release — as that one firms up. It's also worth watching whether the current CVEs land in CISA's KEV catalog, which would formally confirm active exploitation and typically accelerates compliance deadlines for U.S. federal agencies and their vendors. For now, the actionable takeaway hasn't changed: identify every PHP-serving host you run, patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (or your distro's backported equivalent), restart your workers, and if you're stuck on 8.1 or older, treat this as the moment to upgrade rather than patch around it. Developers evaluating where to take their stack next might also find it useful to compare how other parts of the web-serving toolchain are evolving — see our recent look at how Deno, Bun, and Node.js compare in 2026 — though for PHP itself, the near-term move is simply getting current, supported, and patched.

Written byFelix Moreau

Felix Moreau writes Pandromeda's software coverage and how-to guides. He covers Windows, macOS and Linux updates, the apps people rely on, emulators and developer tools, and turns official documentation into clear, numbered steps that work on the current version.

More from Felix MoreauAll Software & Guides coverage