The PHP development team has distributed emergency patches to address two critical remote code execution vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, collectively designated PHP2Shell. Security researchers from Calif, Wiz, and OpenAI discovered these unauthenticated RCE flaws, which impact every PHP installation handling web traffic, spanning PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed configurations.

Both vulnerabilities originate from a shared root cause: PHP can enter a corrupted memory state when a request terminates abnormally. The PHP security team stated, "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."

CVE-2026-109618 permits attackers to execute code under the web worker account by chaining multiple weaknesses that produce out-of-memory corruption. CVE-2026-109619 involves a stale global state vulnerability permitting unauthenticated heap use-after-free, memory disclosure, and code execution with web worker privileges.

Patching guidance

Server operators running PHP 8.x should immediately deploy PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Those operating PHP 7 or earlier versions must transition to a supported release. The PHP developers noted, "PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version."

The PHP development team added, "Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor."

Advance notice and active exploitation

This patch release followed a Tuesday advisory from PHP developers requesting administrators to prepare for immediate deployment. The team stated, "All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."

PHP core developer Gina Peter Banyard cautioned that no mitigation strategy would entirely prevent attacks and that only the official security patches provide lasting protection. Cloudflare CTO Dane Knecht confirmed the company had already observed early exploitation attempts targeting both vulnerabilities. Despite having deployed Web Application Firewall rules designed to counter known PHP2Shell attack methods, Knecht emphasized these defenses were temporary and urged administrators to install patches immediately upon availability.

The UK National Cyber Security Centre has instructed UK organizations to apply updates to PHP-based systems immediately or take them offline pending patching.

Temporary mitigation measures

The PHP security team has published interim mitigation strategies for organizations unable to patch immediately, though these do not provide complete protection against exploitation:

CVE-2026-109618

  • Configure memory_limit=-1, ideally in a manner applications cannot override, such as php_admin_value in the FPM pool or Apache configuration
  • Establish a low post_max_size: 8M for applications without file upload requirements, 32M when uploads are needed
  • Deploy container or cgroup limits as an availability boundary, preferably with a policy terminating only the affected worker

CVE-2026-109619

  • Disable session.upload_progress.enabled and restart all workers
  • On PHP 8.5, set fatal_error_backtraces=0 and restart all workers, which blocks only the confirmed fatal backtrace attack vector
  • Eliminate invalid or deprecated per-request settings that generate diagnostics before initialization; concealing diagnostics through error_reporting, display_errors or @ provides no protection
  • Remediate attacker-accessible fatal errors and execution timeouts, including failures in callbacks, upload or import operations and cleanup routines

PHP (Hypertext Preprocessor) is an open-source server-side web language powering 75% to 80% of all websites, including those built on Content Management Systems such as WordPress, Joomla, and Drupal. VirusTotal data indicates over 5.1 million PHP hosts are accessible online, with approximately 3.8 million having at least one open port.