PHP Patches Critical PHP2Shell Flaws Allowing Unauthenticated RCE

Emergency updates have been issued for a pair of critical remote code execution flaws in the PHP language runtime, collectively tracked as PHP2Shell. The vulnerabilities, assigned CVE-2026-109618 and CVE-2026-109619, permit unauthenticated attackers to execute arbitrary code on web servers running vulnerable PHP configurations. The impact spans virtually all standard deployment models serving web requests—including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Because PHP powers between 75% and 80% of all public websites, including major content management frameworks such as WordPress, Drupal, and Joomla, the vulnerability exposes millions of internet-facing application environments to complete system compromise.

Emergency Patches Released for Critical PHP2Shell Vulnerabilities

The PHP security team rolled out out-of-band updates following joint research by security teams from Calif, OpenAI, and Wiz. The maintainers issued an advance warning advising administrators to prepare their deployment pipelines, citing the extreme risk and reserving the right to release fixed builds ahead of schedule if public exploit code emerged or active in-the-wild exploitation was detected.

Shortly before the official release, Cloudflare confirmed that its telemetry had begun capturing active exploitation attempts targeting the flaws. While Cloudflare deployed Web Application Firewall (WAF) mitigation rules to filter early attack vectors, company leadership emphasized that edge-based rules are only a temporary defense against runtime-level engine bugs. The UK National Cyber Security Centre (NCSC) subsequently published an alert urging UK organizations to apply the security updates immediately or take affected application infrastructure offline until patching is complete.

Technical Breakdown: Memory Corruption and Stale Global State

Both vulnerabilities stem from engine-level memory management failures during abnormal request termination. Under standard execution flow, PHP allocates request-scoped memory structures and tears them down systematically upon completion. However, when an incoming HTTP request terminates unexpectedly—such as through an unhandled memory allocation failure or an engine diagnostic trigger—the core interpreter can leave internal pointers and global state tables in a corrupted condition.

CVE-2026-109618 carries a maximum-severity CVSS v3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting unauthenticated network access, low attack complexity, and zero required user interaction. The flaw involves a chain of weaknesses mapped to CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), and CWE-1325 (Improper Neutralization of Exponent in Numerical Execution). Attackers exploit this chain by intentionally forcing out-of-memory errors during request processing, allowing them to corrupt heap memory and execute code within the context of the web worker process.

The second flaw, CVE-2026-109619, involves a stale global state condition. When triggered, it causes a heap use-after-free scenario and memory disclosure, which can similarly be turned into arbitrary code execution with worker privileges.

The risk profile varies by execution environment, but the PHP development team highlighted Apache running mod_php as the highest-risk architecture. In mod_php deployments, malicious unauthenticated HTTP requests can corrupt execution memory before any user-land application code—including PHP-based authentication checks, input sanitization routines, or application-level security plugins—ever runs.

Observed Active Exploitation and Blast Radius

Threat actors began probing exposed infrastructure prior to the advisory publication, testing HTTP payload combinations designed to trigger memory corruption before web server workers could sanitize input. External internet scanning estimates indicate more than 5.1 million PHP hosts are accessible online, with over 3.8 million displaying exposed web ports.

Because attackers target the interpreter runtime directly, successful exploitation grants direct shell access under the privileges of the underlying web process (e.g., www-data or the FPM pool worker user). From there, adversaries can read application configuration files containing database credentials, inject persistent web shells into public directories, or move laterally across local server environments.

Recommended Remediation and Workarounds

Organizations should update production environments immediately to fixed versions:

• PHP 8.5: Upgrade to 8.5.12 or later
• PHP 8.4: Upgrade to 8.4.27 or later
• PHP 8.3: Upgrade to 8.3.36 or later
• PHP 8.2: Upgrade to 8.2.35 or later

Mainstream support for PHP 8.1, 8.0, and 7.4 has officially ended. However, given the severe impact of PHP2Shell, the PHP security team released minimal source-level backports for PHP 7.4, 8.0, and 8.1 for teams that compile from source. System administrators using distribution packages or Long-Term Support (LTS) operating system repositories should consult their respective package vendors for backported fixes or expedite migration to a supported 8.x branch.

If immediate patching cannot be completed, the PHP maintainers recommend applying temporary configuration adjustments to shrink the attack surface:

1. For CVE-2026-109618: Enforce memory_limit = -1 at the web server administrative level (using php_admin_value within Apache or FPM pool configurations) so application scripts cannot override it. Reduce post_max_size to 8M (or 32M if upload workflows require it). Rely on OS-level cgroups or container memory limits to constrain process boundaries and terminate corrupted workers.
2. For CVE-2026-109619: Disable session upload progress tracking by setting session.upload_progress.enabled = 0 in php.ini and restarting all pool workers. On PHP 8.5 installations, set fatal_error_backtraces = 0 to close the confirmed backtrace attack path. Clean up invalid or deprecated per-request configuration options that emit diagnostics prior to engine initialization.