PHP2Shell (CVE-2026-109618 and CVE-2026-109619): what it is, who is affected and how to mitigate it

On 21 October 2026 the PHP project released security updates for two critical vulnerabilities in the language core, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both allow an attacker without credentials to execute code on a web server running PHP. This article describes the mechanism of each flaw, defines which installations are exposed, and orders the remediation steps by how PHP reaches each server. By the end, the reader will be able to decide whether a server is protected and confirm it with evidence.

The PHP project's guidance is unambiguous: "There are no complete mitigations, updating is the only safe choice." The interim measures described below reduce exposure; they do not remove it.

An explanation for readers who do not run servers

PHP is the language behind a large share of websites, online stores and internal systems; WordPress, Joomla, Drupal, Moodle, Magento and Laravel, among others, depend on it. When a visitor opens a page, the server runs PHP to build the response.

PHP2Shell is a defect in that foundation, not in a plugin or in the website itself. A deliberately crafted request can push PHP into an inconsistent internal state and, from there, make the server run the attacker's instructions. In practice that means handing over control of the server: reading databases, stealing passwords, altering the site or installing malware.

If your organization runs a site or system on PHP, the question to put to your hosting provider or technical team today is specific: "Which PHP version serves our site, and when were the workers restarted after updating it?" Keeping plugins up to date does not protect against this flaw; updating PHP does.

Mechanism of the two vulnerabilities

Both flaws sit in the memory management PHP performs for each web request. A worker is the PHP process that serves requests one after another; between requests, PHP is expected to free and reset all state that belonged to the previous one.

CVE-2026-109618, out-of-memory corruption. According to PHP's advisory (GHSA-w8hw-w9fx-j79w), out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid. An attacker who deliberately exhausts memory with a large or complex request can exploit that inconsistency.

CVE-2026-109619, stale global state. According to advisory GHSA-6wmf-4rv5-p3rp, request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it. This is a use-after-free: the program keeps using a reference to memory it no longer owns. PHP lists code execution and memory disclosure as confirmed impacts.

PHP rated both at 9.2 on CVSS v4.0, the standard severity scale, whose maximum is 10. The PHP Foundation clarified that the identifiers circulated before release carried an incorrect score of 10.0.

Affected and fixed versions

Published research places the vulnerable code from PHP 5.4 through 8.5.11. Official fixes exist only for supported branches:

Branch	Fixed version	Status
8.5	8.5.12	Active support
8.4	8.4.27	Active support
8.3	8.3.36	Security fixes only
8.2	8.2.35	Security fixes only; end of life on 31 December 2026
7.4, 8.0 and 8.1	No official release	End of life; the security team published minimal source backports
5.4 to 7.3	No fix	End of life; the only path is migrating to a supported branch

Linux distributions and extended-support vendors received the patches in advance. In distribution packages the version number may not match the table, because the patch is applied to the version the distribution maintains; the reference in that case is the vendor's advisory for both CVEs. The PHP 8.6.0 RC4 test build also includes the fix but is not intended for production.

Exposed installations

PHP states that every installation serving web requests is at risk, under any of its execution modes (SAPIs): PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for mod_php, where the demonstrated exploit is triggered by an unauthenticated request before any application code runs. How well the application is written is therefore irrelevant: the entry point sits beneath it.

Scripts that run only from the command line and receive no web traffic fall outside this vector, although updating them in the same cycle avoids maintaining two versions.

Exploitation status

The identifiers leaked on 20 October and the project moved the planned 22 October release forward by one day. Cloudflare reported early attack attempts and deployed WAF rules on all plans, including the free tier, describing them as a stopgap that only covers traffic routed through its network. Public exploit code is circulating, with its effectiveness not yet independently verified. With three earlier PHP vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, the prudent assumption is that any unpatched server is an active target.

Remediation by installation channel

The action is the same everywhere, update and restart, but the procedure depends on how PHP was installed:

• Distribution packages (Debian, Ubuntu, Red Hat, Oracle Linux, Alpine and similar): install the security updates published for both CVEs and confirm in the vendor advisory that the installed package includes them. Third-party repositories such as Ondřej Surý's or Remi's are updated separately.
• Containers: rebuild the image on a fixed base (for example, pull php:8.4-fpm again before building) and redeploy. An image that is already built does not fix itself, even if the upstream tag has been updated.
• Shared or panel-based hosting (cPanel, Plesk, CloudLinux): the update depends on the provider. Ask in writing for the applied version and date; where the panel has a version selector, move the site to a supported branch.
• Managed platforms: some apply the patch automatically and others require a redeploy. Google Cloud, for example, updates App Engine Standard on PHP 8.2 or later, while App Engine Flexible and Cloud Run without automatic base image updates require a new deployment.
• Self-compiled builds: build from the sources on php.net. For 7.4, 8.0 and 8.1, the project published branches with minimal backports (example for 8.1); they are a transition measure, not a substitute for migrating.

After updating, restart every worker: PHP-FPM, Apache or the application server. A process already in memory keeps running the old binary even when the new package is installed.

Interim mitigations while updating

PHP's advisory lists measures for the window before the update and warns that they do not make an installation safe. They are set in php.ini, the FPM pool or the web server configuration, never through ini_set() or .user.ini, and require restarting the workers.

For CVE-2026-109618:

• memory_limit=-1, preferably with php_admin_value so no application can override it. With PHP's internal limit removed, the memory boundary should move to the container or cgroup, ideally one that kills only the affected worker. PHP advises against RLIMIT_AS or RLIMIT_DATA for this purpose.
• post_max_size = 8M for applications without file uploads, or 32M if they need them, with upload_max_filesize below that value.
• Limits at the web server or proxy for decoded request size, field count, multipart part count, header count and nesting depth, also enforced on requests without a usable Content-Length.

For CVE-2026-109619:

• session.upload_progress.enabled=0.
• PHP 8.5 only: fatal_error_backtraces=0.
• Remove invalid or deprecated per-request settings that emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors or @ does not help.
• Fix attacker-reachable fatal errors and execution timeouts, including those in callbacks, upload or import processing, and cleanup.

As an additional layer, a WAF with rules for this campaign (Cloudflare, Google Cloud Armor or another) and blocking oversized request bodies before they reach PHP reduce the attack surface. CERT-EU also recommends isolating exposed applications from public networks until the fix is applied and verified, where the business allows it.

End-to-end response process

The diagram below brings the decisions of the previous sections together in BPMN 2.0 notation. Highlighted tasks are the ones that fix or contain the risk; interim mitigation is a detour that always leads back to the update.

Verification procedure

The check must target the PHP that serves the web, not only the one in the terminal: several versions can coexist on the same server, and php -v reports only the command-line build.

1. Inventory every server, container and hosting account that runs PHP, including test environments and forgotten systems reachable from the internet.
2. Obtain the version served on the web: php-fpm -v (or php-fpm8.4 -v, depending on the distribution), or a temporary, protected phpinfo() page deleted afterwards.
3. Compare it with the fixed-version table or, for distribution packages, with the vendor advisory.
4. Confirm that workers were restarted after the update, for example with systemctl status php8.4-fpm and the service start time.
5. If interim mitigations were applied, confirm their effective value in phpinfo() under Local Value, which reflects what the application actually sees.
6. For servers that were exposed while unpatched, review access logs for unusually large requests, unexpected worker restarts, new or modified PHP files in public directories, scheduled tasks and administrative users nobody recognizes. If there are signs of intrusion, updating is not enough: an incident analysis and credential rotation are required.

Frequently asked questions

Is my WordPress site affected?

Yes, if the server runs a PHP version older than the fixed ones. The flaw is in PHP, not in WordPress or its plugins, so updating WordPress does not resolve it.

Is changing php.ini enough?

No. PHP describes those measures as partial. They buy time while updating; they do not replace the update.

I run PHP 7.4 or 8.1. What are my options?

In the short term, a patch from the distribution or an extended-support vendor, or a build from the minimal backport branches the project published. In the medium term, migrating to PHP 8.3 or 8.4, which usually requires reviewing the compatibility of the application and its dependencies.

I am behind Cloudflare. Am I already protected?

Partially. The WAF rules filter known vectors, and only for traffic that passes through Cloudflare. If the server also answers on its direct address, or a variant of the attack appears, that protection does not apply.

Sources

• PHP, security advisory of 21 October 2026.
• php-src GitHub Security Advisories: GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
• Tenable, PHP2Shell frequently asked questions.
• Google Cloud, responding to CVE-2026-109618 and CVE-2026-109619.
• Qualys, analysis of the security release.

Support applying the fix

Xterra Engine inventories PHP servers, applies the update with a controlled restart, verifies the result and, where a version is out of support, plans the application's migration. To request support or a quote, write to info@xterraengine.com or use the contact form, noting how many servers or sites run PHP and where they are hosted.