PHP2Shell: Critical PHP vulnerabilities patched, update now!

The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging all PHP users to update immediately.

Who is affected?

Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Setups using mod_php face the greatest danger. A working exploit has already shown that a single unauthenticated request can trigger the attack before any application code runs.

“The PHP situation will lead to a mass of incidents – it’s one of the biggest vulns in years,” noted security researcher Kevin Beaumont.

The vulnerabilities

CVE-2026-109618 – RCE via OOM corruption: out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

CVE-2026-109619 – RCE via stale global state: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

The UK’s National Cyber Security Centre (NCSC) is urging organizations to consider taking offline any system that can’t be fixed right away.

“So many embedded installations out there that will never be patched. Too many forgotten, unmaintained apps. There will be a long tail for this one,” commented computer forensics expert Hal Pomeranz.

How can you fix CVE-2026-109618 and CVE-2026-109619?

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Downloads are available here.

Linux distributions and long-term support (LTS) vendors got the patches ahead of the public release, so admins should check with their vendor for updated packages.

The PHP project no longer supports PHP 8.1 and earlier versions. Some distributions and LTS vendors offer backported fixes, so users on these versions should contact their vendor or upgrade to a supported release.

Anyone who relies on rpms.remirepo.net, a volunteer-maintained repository, is advised to switch to distribution packages or build PHP from source so they can patch immediately. The repository will not have updates available today.

Because the vulnerabilities are so severe, the PHP security team has also released minimal source backports for PHP 7.4, 8.0 and 8.1. These are meant for people who build from source or who don’t have an LTS vendor.

“PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free,” said Dane Knecht, CTO at Cloudflare.