PHP releases emergency fixes for two PHP2Shell RCE vulnerabilities

PHP has issued emergency updates for two critical PHP2Shell vulnerabilities that can allow an unauthenticated attacker to execute code on a web server. The fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0.

Cloudflare said it was seeing early exploit attempts before the patches shipped, although the available reports did not confirm a successful compromise. PHP released the updates on October 21 after information about a planned October 22 disclosure leaked.

Runtime flaws extend beyond application security

The vulnerabilities are in the PHP engine rather than in a particular framework or website. That means a vulnerable server can remain exposed even where its application code is secure; PHP said even a simple Hello World page can be targeted.

The advisory lists PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed among affected web-serving deployments. Apache mod_php is described as the highest-risk configuration because a demonstrated exploit can be triggered by one unauthenticated request before any application code executes.

PHP-FPM has a different failure pattern because it terminates a worker when a request fails early during setup. PHP said one flaw is susceptible in FPM without a complete demonstrated exploit, while the other was shown to lead to code execution on mod_php and PHP-FPM. The FPM route for the latter depends on an operation in the running application.

The researchers also demonstrated reading live memory from PHP worker processes without first obtaining code execution. Such memory may contain passwords, authentication tokens, API keys and certificates associated with other requests.

Patch the serving runtime and restart workers

Updating WordPress, Laravel or another application does not upgrade the PHP runtime underneath it. Administrators need to update the server package, hosting image or container image that provides PHP, then restart Apache, PHP-FPM and any long-running PHP workers.

• PHP 8.5 installations need version 8.5.12 or later.
• PHP 8.4 installations need version 8.4.27 or later.
• PHP 8.3 installations need version 8.3.36 or later.
• PHP 8.2 installations need version 8.2.35 or later.

PHP 8.1 and older no longer receive project updates. Source backports are available for PHP 7.4, 8.0 and 8.1 for organisations that build from source or are waiting for a vendor package. Distribution packages may include the fix while retaining an older-looking version number, so Debian advises checking the package changelog for the CVE identifiers.

Workarounds do not make affected servers safe

PHP states that only updating fully resolves the issue. For CVE-2026-109618, the advisory suggests setting memory_limit=-1, keeping post_max_size low and enforcing request-size limits at a proxy or web server to reduce exposure. It warns against using RLIMIT_AS or RLIMIT_DATA as substitutes.

For CVE-2026-109619, disabling session.upload_progress.enabled and restarting every worker blocks confirmed session paths, but not other variants. PHP 8.5 deployments should also set fatal_error_backtraces=0. The setting circulated before release as a workaround, but the release confirms it was not a complete mitigation.

After upgrading, teams should review memory settings because the new hard memory limit terminates the process and prevents shutdown handlers from running when reached. For organisations that suspect an earlier intrusion, the researchers recommend watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unusually large PHPSESSID cookies and unexplained PHP worker restarts.

The immediate business task is to identify every internet-facing PHP runtime, validate the vendor patch status rather than relying on application updates, restart affected services and treat temporary configuration changes only as exposure reduction until the runtime is fixed.