PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.

The two PHP2Shell unauthenticated RCE flaws affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

"We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs," the PHP security team said.

Both flaws stem from the same underlying problem: PHP can leave its memory in a corrupted state when a request ends abnormally, and both can be exploited to achieve remote code execution.

CVE-2026-109618 can be used to gain remote code execution as the web worker account by exploiting a chain of weaknesses that trigger out-of-memory corruption, while the CVE-2026-109619 stale global state vulnerability enables unauthenticated heap use-after-free, memory disclosure, and remote code execution with the web worker's privileges.

Admins should install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible on servers running PHP 8.x and migrate to a fixed release if they're running PHP 7 or earlier.

"PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version," the PHP developers added.

"Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor."

Advanced warning

This follows a Tuesday warning from PHP developers urging administrators to prepare to install these security updates as soon as they're released.

"All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available," they said. "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."

PHP core developer Gina Peter Banyard warned that no PHP2Shell mitigations exist and that applying the official security patches is the only permanent defense against attacks.

Before the patches were released, Cloudflare CTO Dane Knecht confirmed that the company (which had already deployed a set of WAF rules designed to block known PHP2Shell exploitation methods) was already observing early attacks targeting the two vulnerabilities. However, Knecht also stressed that these protections were temporary and urged all admins to install the PHP security updates as soon as they become available.

The UK National Cyber Security Centre (NCSC) has also warned UK organizations to immediately update systems using PHP or take them offline until they can be patched.

PHP (Hypertext Preprocessor) is an open-source, server-side web development language that powers 75% to 80% of all websites, including those using Content Management Systems (CMS) like WordPress, Joomla, and Drupal.

According to VirusTotal estimates, over 5.1 million PHP hosts are exposed online, with roughly 3.8 million having at least one port open.