PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What to Patch Now

On October 21, 2026, the PHP project shipped emergency security releases for two critical flaws in the language runtime itself. Researchers call the pair PHP2Shell. Both bugs carry a CVSS v4.0 score of 9.2, both can lead to unauthenticated remote code execution, and because they live in the PHP engine rather than in any one application, a site can be exposed even when its own code is clean.

PHP2Shell at a Glance

What Is PHP2Shell?

PHP2Shell is the name for two memory-safety bugs in PHP's core runtime. Both involve a request being interrupted partway through, typically by an out-of-memory condition, so that internal state is left half-initialized or freed but still referenced. A later step, or a later request handled by the same reused worker, then treats that stale memory as valid. In the right conditions an attacker can turn that into code execution on the server.

The Two Vulnerabilities

Sansec's analysis notes that CVE-2026-109618 can return freed worker memory to the client in a response cookie, and that this runs before application code. That memory may contain passwords, session tokens, API keys, or TLS private keys. It also means the exposure does not depend on whether your application ever calls session_start().

Who Is Exposed?

Any server using PHP to answer web requests is in scope, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Apache mod_php is the highest priority because PHP's own team demonstrated an exploit there that triggers before application code runs. The vulnerable code dates back to PHP 5.4.0 in 2012, so the affected population is very large.

Qualys data from roughly 12,000 customers found about 167 million PHP installations, around 73 to 74 percent of them on internet-facing assets. Of the 155 million with a known version, about 110 million (71 percent) run end-of-life or end-of-support branches, 5.4 through 8.1, which will not receive a regular upstream fix. Only about 199,000 were patched in the first 12 hours.

Platforms such as WordPress, Drupal, Joomla, Magento, WooCommerce, and Shopware run on PHP and are therefore in the blast radius. Network and security appliances that bundle PHP are affected too: Palo Alto Networks confirmed all PAN-OS and Panorama versions are affected, and Fortinet and Cisco were still assessing their products as of the latest update.

Is It Being Exploited?

Yes, but the picture is more nuanced than the headline CVSS score suggests.

• Amazon's MadPot honeypot recorded an exploitation attempt on October 17, 2026, four days before public disclosure, from an IP tied to a commercial anonymization service.
• Cloudflare reported early attack traffic on October 21, including attempts to evade its protections, and deployed WAF rules available to all customers.
• Sansec's assessment is that mass exploitation looks less likely than first feared: public proof-of-concept exploits reportedly do not work against a default PHP installation, and several depend on a separate local file inclusion bug in the application.
• Wiz attributes the lowered barrier to exploitation to frontier AI models, which made a long-standing flaw practical to weaponize. Expect exploit reliability to improve as more research is published.

The practical takeaway: treat a lack of a universal one-request exploit as breathing room, not as a reason to wait. The UK NCSC advised organizations to consider taking offline any system that cannot be fixed immediately.

How to Patch

1. Inventory every PHP installation, including parallel branches, containers, hosting-panel packages, and PHP bundled inside appliances. The output of php -v may come from a different binary than the one serving requests.
2. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. On PHP 8.1 or older, use your distribution's backported package, apply the PHP security team's source patch, or move to a supported branch. The official Docker php image gets no fix for 8.1 or older.
3. Check the full package version and changelog against your vendor advisory, since distributions keep older version numbers when they backport fixes.
4. Restart or replace every worker and service that loads PHP. Running workers keep the vulnerable code in memory until restarted.
5. Rescan the assets and confirm the exploit path is closed. If you use the volunteer-run remirepo repository, check for updates, as none were available on release day.

Temporary Mitigations If You Cannot Patch Yet

These reduce exposure but do not remove the vulnerabilities, and some carry operational cost. Use them only to buy time, and give each system an owner and a deadline.

• Disable session.upload_progress.enabled in php.ini, the FPM pool, or server config, then restart workers. Setting it at runtime or in .user.ini is not sufficient.
• Restrict or block multipart/form-data requests you do not need at the web server or proxy. This breaks file uploads and some checkout forms, so test first.
• Enforce request-size and complexity limits at the proxy, and keep post_max_size and upload_max_filesize modest.
• Use container or cgroup memory limits as an availability boundary. Researchers suggested memory_limit=-1 as a partial mitigation for one CVE, but removing the cap lets a single request consume all server memory, so monitor closely and restore a finite limit after patching.
• Turn on Cloudflare's WAF protections if you use Cloudflare, and isolate or restrict public access to any service you cannot patch.

What Your SOC Should Watch For

Patching closes the door, but anyone who was exploited before the fix is already inside it. Because the earliest attempts predate disclosure, review the past two weeks of telemetry on PHP-facing hosts and not just the hours since the patch.

• Unusual or oversized multipart/form-data requests to PHP endpoints, especially from anonymization services or hosting IP ranges.
• Repeated PHP worker crashes, out-of-memory errors, or fatal-error spikes on web servers.
• Child processes spawned by the web server or PHP-FPM workers, such as shells, curl, wget, or scripting interpreters.
• New or modified files in web roots, new cron entries, and unexpected outbound connections from web-facing servers.
• Credential or API key use from new locations, since CVE-2026-109618 can expose secrets held in worker memory. Rotate high-value secrets on hosts you cannot confirm were clean.

The hard part is that none of these signals is conclusive alone. A crashed worker, a strange upload, and a new outbound connection each look like noise in separate tools. This is the kind of cross-source correlation VORXOC is built for: it stitches web, endpoint, cloud, and network telemetry into a single incident so analysts see the chain rather than three unrelated alerts. For teams without round-the-clock coverage to run that triage, Helxon's SOC as a Service puts analysts on it 24/7. To understand how detection and response tooling fit together, see our guide to SIEM vs SOAR.

The Bigger Lesson

PHP2Shell is a reminder that the exposure window for a critical flaw is now measured in days, sometimes less than the disclosure process itself. A flaw that sat unnoticed in the runtime for over a decade was weaponized before most defenders had a patch to apply. Organizations that fare best are not the ones that never see a critical CVE, but the ones that already know where every runtime lives, can patch and restart quickly, and have the monitoring in place to spot the attempts that arrive first.

Want help assessing exposure or monitoring for exploitation? Start a free 90-day VORXOC trial or book a demo.

Sources

• Sansec: PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619), sansec.io/research/php2shell
• Qualys: Two Critical PHP Flaws Could Hand Attackers Your Web Servers, blog.qualys.com (October 20, 2026)
• Help Net Security: PHP2Shell: Critical PHP vulnerabilities patched, update now! (October 21, 2026)
• Cloudflare: Cloudflare deploys protections against php2shell vulnerability, blog.cloudflare.com

Frequently Asked Questions