"CVE-2026-109618 and CVE-2026-109619" — two critical, unauthenticated remote code execution flaws tracked together as PHP2Shell — are forcing an immediate, global upgrade effort across PHP-hosting infrastructure.
The vulnerabilities: CVE-2026-109618 and CVE-2026-109619
The PHP security team says both PHP2Shell flaws stem from the same underlying problem: PHP can leave its memory in a corrupted state when a request ends abnormally, and both can be exploited to achieve remote code execution. CVE-2026-109618 uses a chain of weaknesses that trigger out-of-memory corruption to gain remote code execution as the web worker account. CVE-2026-109619 is a stale global state vulnerability that enables unauthenticated heap use-after-free, memory disclosure, and remote code execution with the web worker's privileges.
The security team warned that the risk is not abstract: "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs," the PHP security team said.
Deployments and configurations affected
The PHP2Shell flaws affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Given those footprints, the PHP team called the situation urgent: administrators of web servers running PHP are the primary group at immediate risk.
The source material also notes the broader exposure: PHP powers "75% to 80% of all websites, including those using Content Management Systems (CMS) like WordPress, Joomla, and Drupal." VirusTotal estimates cited in the advisory put over 5.1 million PHP hosts exposed online, with roughly 3.8 million having at least one port open.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogPatches, versions, and vendor backports you can apply now
The PHP security team released emergency security patches and advised administrators to install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 "as soon as possible" on servers running PHP 8.x and to migrate to a fixed release if they're running PHP 7 or earlier. The developers noted that "PHP 8.1 and older no longer receive updates from the PHP project" but added that "some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version."
To assist organizations that build from source or lack LTS vendor support, the PHP project provided "minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1."
Temporary mitigations the PHP security team published
The PHP security team made clear that workarounds do not fully prevent exploitation, but listed measures to reduce exposure while administrators prepare or deploy patches. Key recommendations include:
- For CVE-2026-109618: set memory_limit=-1, preferably via php_admin_value in the FPM pool or Apache configuration so applications cannot override it; set a low post_max_size (8M for applications that don’t require file uploads, 32M if uploads are necessary); and use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker.
- For CVE-2026-109619: set session.upload_progress.enabled=0 and restart every worker; on PHP 8.5 set fatal_error_backtraces=0 and restart every worker (this blocks only the confirmed fatal backtrace path); remove invalid or deprecated per-request settings that emit diagnostics before initialization (hiding diagnostics with error_reporting, display_errors or @ does not help); and fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup.
How Cloudflare, the UK NCSC, and the PHP team responded
Earlier in the week PHP developers warned administrators to prepare to install updates as soon as they became available, stating they "reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." PHP core developer Gina Peter Banyard warned that "no PHP2Shell mitigations would fully block potential attacks and that applying the official security patches is the only permanent defense."
Cloudflare CTO Dane Knecht confirmed his company — which had deployed WAF rules to block known PHP2Shell exploitation methods — was already observing early attacks targeting the two vulnerabilities, but he also stressed those protections were temporary and urged all admins to install the PHP security updates as soon as they become available.
The UK National Cyber Security Centre (NCSC) warned UK organizations to "immediately update systems using PHP or take them offline until they can be patched."
What this means for technologists, enterprises, and end users
Technologists and security teams: prioritize patching web servers running PHP 8.x to the specified fixed releases, verify any vendor backports if you run PHP 8.1 or older, and treat the listed mitigations as temporary stopgaps rather than long-term fixes.
Enterprises and procurement leaders: confirm which hosted and managed services in your environment run affected PHP deployments and require immediate patching or isolation; ask vendors whether they will provide backported fixes or require migration to supported releases.
End users and site operators: be prepared for short-term service interruptions if administrators take systems offline to patch, and expect defenders' temporary protections (WAF rules, configuration changes) to reduce some attack paths but not to eliminate the underlying risk.
The PHP2Shell advisory is a clear, narrow-scope technical emergency: memory corruption in PHP request handling that can be weaponized without authentication. The only permanent remedy the PHP project endorses is installing the released fixes or obtaining verified vendor backports. With early exploitation already observed and public mitigations incomplete, the immediate metric is simple — apply the specified patched releases or authoritative backports without delay.
