Two critical remote code execution (RCE) vulnerabilities in core PHP—tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell—allow unauthenticated attackers to execute arbitrary code on internet-facing web servers. Disclosed via emergency security releases on October 21, 2026, both vulnerabilities carry a CVSS v4.0 severity score of 9.2 and are actively exploited in the wild. System administrators must immediately upgrade affected deployments to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, as official PHP security advisories confirm that no configuration change fully mitigates the underlying memory corruption flaws.
Understanding the PHP2Shell Vulnerability Mechanics
The PHP2Shell vulnerabilities were originally discovered by security researchers at Calif and reported to the PHP security team for coordinated disclosure scheduled for October 22, 2026. However, after technical details leaked on social media on October 20, 2026, the PHP development team accelerated its response and published emergency patches on October 21, 2026 at 14:00 UTC. Security intelligence firm watchTowr confirmed active in-the-wild exploitation through its Attacker Eye global honeypot network on the same day patches were released, prompting emergency alerts from CISA, ENISA, and the Canadian Centre for Cyber Security.
Unlike application-layer vulnerabilities that depend on specific framework routes or insecure developer code, PHP2Shell targets the core PHP runtime engine during request initialization and worker recycling. This means any web server processing HTTP requests through vulnerable PHP binaries is potentially exposed, regardless of the content management system or custom application running on top of it.
CVE-2026-109618: Out-of-Memory Request Setup Corruption
The first flaw, CVE-2026-109618, is a memory corruption vulnerability triggered when the PHP interpreter exhausts available memory partway through initializing an incoming HTTP request. When an out-of-memory condition occurs during specific stages of request setup, internal data structures remain only partially initialized. During the subsequent request cleanup routine, the PHP engine trusts these half-built pointers, allowing a carefully crafted request payload to corrupt memory and redirect execution flow before application logic is even invoked.
CVE-2026-109619: Stale Global State Across Worker Processes
The second vulnerability, CVE-2026-109619, stems from improper lifecycle management of internal global state across persistent PHP worker processes. In multi-request SAPI architectures where a single worker handles sequential requests, internal state pointers can outlive the per-request memory pool they reference. When the same PHP worker picks up a subsequent HTTP request, it can act upon dangling pointers left behind by the prior request, enabling unauthenticated remote code execution or unauthorized memory disclosure across tenant boundaries.
Affected PHP Versions and SAPI Exposure Matrix
Every PHP installation that serves web requests is in scope for remediation. According to the Unit 42 Palo Alto Networks threat brief and watchTowr's technical validation, exposure spans both actively supported branches and end-of-life (EOL) releases dating back to PHP 5.
PHP Release Branch Vulnerable Versions Official Fixed Version Support and Remediation Status
PHP 8.5.x All versions prior to 8.5.12 8.5.12 Active support; official binary and source patch available
PHP 8.4.x All versions prior to 8.4.27 8.4.27 Active support; official binary and source patch available
PHP 8.3.x All versions prior to 8.3.36 8.3.36 Security support; official patch available
PHP 8.2.x All versions prior to 8.2.35 8.2.35 Security support; official patch available
PHP 7.4, 8.0, and 8.1 All releases No official point release End of life; use Linux distro LTS packages or minimal source backports
PHP 7.3 and older (including PHP 5) All releases None available Unsupported; migrate immediately to a supported PHP 8.x branch
Why Apache mod_php Faces the Highest Risk
While PHP-FPM, php-cgi, LiteSpeed, and FrankenPHP deployments are all affected and require urgent patching, the PHP security advisory notes that exposure is most acute on servers running Apache mod_php. In mod_php environments, PHP runs directly inside the Apache worker process and processes request headers and memory allocation before any application-level middleware or authentication checks execute. Consequently, internet-facing servers using mod_php should be prioritized at the top of your emergency patching queue.
Step-by-Step Remediation and Verification
Because PHP states that no php.ini configuration change or web application firewall (WAF) rule can completely eliminate the underlying memory safety defects, installing the patched runtime packages and restarting worker processes is mandatory.
1. Inventory All Internet-Facing and Internal PHP Instances
Audit all virtual machines, bare-metal servers, container images, and developer preview environments. Do not rely solely on central asset registries; scan for legacy shadow IT systems and containerized microservices running older PHP 7.x or 8.0/8.1 base images. Check both the CLI binary and the active web SAPI version, as servers frequently have multiple PHP versions installed side by side.
2. Apply Vendor Patches and Restart Worker Processes
Linux distributions received embargoed patches ahead of the October 21 public disclosure. Update your system packages through your operating system package manager (such as apt on Ubuntu/Debian or dnf on RHEL/AlmaLinux) or rebuild Docker containers using updated upstream tags. Crucially, updating the package on disk does not replace binaries already loaded into RAM. You must explicitly restart all PHP-FPM pools, Apache workers, LiteSpeed processes, or FrankenPHP instances so the patched binary takes effect.
3. Handling End-of-Life PHP 7.4, 8.0, and 8.1 Systems
Organizations maintaining legacy workloads on PHP 7.4, 8.0, or 8.1 cannot pull an official upstream release from php.net. Instead, rely on vendor-maintained Extended Lifecycle Support (ELS) repositories from Ubuntu Pro, Red Hat Enterprise Linux, or Debian LTS, or apply the minimal source backports provided by the PHP group. If an older PHP 5 or 7.0–7.3 server cannot be upgraded immediately, restrict network access at the firewall or reverse-proxy layer so the server is unreachable from the public internet.
Defense-in-Depth and Cloud Security Monitoring
While patching is underway, security operations teams should deploy network-level detection signatures and review server logs for anomalous HTTP requests causing repeated worker crashes, segmentation faults (SIGSEGV), or out-of-memory fatal errors in PHP-FPM and Apache error logs. Cloud-native teams should consult Google Cloud's Security Command Center guidance and CrowdStrike's endpoint detection advisories to identify post-exploitation web shells or unauthorized child processes spawned by php-fpm or httpd.
Frequently Asked Questions
What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
PHP2Shell refers to two critical Remote Code Execution vulnerabilities in core PHP disclosed on October 21, 2026. CVE-2026-109618 involves out-of-memory corruption during request setup, while CVE-2026-109619 involves stale global state persisting across requests in PHP workers. Both are rated CVSS v4.0 9.2.
Which patched PHP versions fix CVE-2026-109618 and CVE-2026-109619?
The PHP development team released fixed versions PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35 on October 21, 2026. Every release prior to these versions is vulnerable, including older unsupported branches like PHP 7.x and PHP 5.
Can I mitigate PHP2Shell using php.ini settings without upgrading?
No. Official PHP advisories state that no configuration change in php.ini can fully mitigate CVE-2026-109618 or CVE-2026-109619. While WAF rules can help block known exploit payloads temporarily, upgrading the PHP binary and restarting all worker processes is the only complete fix.
Are PHP-FPM and Nginx servers vulnerable, or only Apache mod_php?
Every PHP SAPI that serves web requests—including PHP-FPM with Nginx, Apache mod_php, php-cgi, LiteSpeed, and FrankenPHP—is vulnerable and must be patched. Apache mod_php faces the highest immediate risk because exploitation can succeed before any application code runs.
Comments (0)
Leave a Comment