Critical PHP Vulnerabilities Enable Unauthenticated RCE (PHP2Shell)
Critical PHP Vulnerabilities Enable Unauthenticated RCE (PHP2Shell)
Severity: CRITICAL (CVE-2026-109618, CVE-2026-109619)
CVSS Score: 9.2
Information
PHP is a server-side scripting language, which is essential for handling data in websites and web applications.
Incident
On October 21, 2026, the PHP development team released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
• CVE-2026-109618: Out-of-memory handling may leave internal request data partially initialized. Subsequent cleanup may treat invalid memory as valid, potentially leading to memory corruption and remote code execution.
• CVE-2026-109619: PHP request-related global state may retain references to memory that has already been freed. A later request handled by the same worker may use stale state, potentially leading to remote code execution.
Both vulnerabilities have a CVSS v4.0 score of 9.2 and affect nearly all PHP versions dating back to PHP 5.4. What makes these vulnerabilities particularly dangerous is that they originate in the PHP engine itself. Systems using Apache with mod_php are at the highest risk, as a single unauthenticated request can trigger the exploit before the application code is executed. PHP-FPM behaves differently because it terminates workers when requests fail during the early processing stage.For CVE-2026-109618, PHP's analysis indicates that PHP-FPM is vulnerable, although a complete exploit has not yet been demonstrated. In contrast, CVE-2026-109619 has been proven to allow code execution on both mod_php and PHP-FPM.
If successfully exploited, unauthenticated attackers could execute code with the privileges of the PHP process, access data readable by the process, or cause service disruptions. Proof-of-Concept (PoC) details have reportedly been published, making it essential to prioritize remediation efforts.
Affected Products / Versions
•PHP 8.5.0–8.5.11
•PHP 8.4.0–8.4.26
•PHP 8.3.0–8.3.35
•PHP 8.2.0–8.2.34
•PHP 8.1 and earlier version.
Recommendation
•Upgrade PHP 8.5 to 8.5.12 or later
•Upgrade PHP 8.4 to 8.4.27 or later
•Upgrade PHP 8.3 to 8.3.36 or later
•Upgrade PHP 8.2 to 8.2.35 or later
•For PHP 8.1 and earlier, migrate to a supported release or apply a verified vendor-provided fix. Prioritise internet-facing systems.
•Set session.upload_progress.enabled=0 and memory_limit=-1 in your php.ini file. Note that these are only partial mitigations, it’s still recommended to update the PHP version instead.
•Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP. NCSC-NL have published an inventory list of software products with a PHP dependency potentially affected by the vulnerabilities. Apply relevant updates as they become available.
References
•https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
•https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
• https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation
• https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
•https://www.hackthebox.com/blog/php2shell-php-rce-vulnerabilities
•https://www.offsec.com/blog/php2shell-critical-vulnerabilities-in-php-core/