PHP2Shell: Two Critical PHP Vulnerabilities Allow Remote Code Execution Without Authentication

The PHP project published emergency fixes on October 21, 2026, for two critical vulnerabilities in the language's core, dubbed PHP2Shell: CVE-2026-109618 and CVE-2026-109619, both with CVSS v4.0 9.2. They allow unauthenticated remote code execution (RCE).

The most important point: the problem lies in the PHP runtime, not in the applications. A website can have secure code and still be vulnerable.

What the vulnerabilities do

• CVE-2026-109618, memory corruption due to out-of-memory (OOM). If a request hits the memory_limit at the wrong time, PHP can leave internal data partially initialized and treat it as valid, corrupting memory. In Apache with mod_php, an unauthenticated request can trigger the flaw before any application code runs, and remote execution has been demonstrated with default configurations. In PHP-FPM, RCE was confirmed through application-level code paths.
• CVE-2026-109619, stale state. A fatal error at the wrong point can leave the internal state pointing to memory from a previous request, which a subsequent request in the same worker reuses after it has been freed (use-after-free). RCE was demonstrated in a real application under Apache with mod_php.

According to The Hacker News coverage, both vulnerabilities can also leak worker memory, potentially containing passwords, tokens, and keys from other requests.

Who is exposed

Every PHP installation that serves web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. According to the coverage, almost all versions from PHP 5.4 up to 8.5.11 are affected. PHP can be embedded in other software, so it is not always visible in the inventory.

How to fix

The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

1. Inventory everything that runs PHP, starting with internet-exposed systems.
2. Update and restart Apache, PHP-FPM, and long-running workers. Without a restart, the old process remains vulnerable.
3. On Linux distributions, the patch may have been applied without changing the version number. Check the package changelog for the CVE number.
4. After updating, review memory_limit and post_max_size. The new hard memory limit terminates the process and prevents shutdown handlers from running, which may affect applications that relied on them.

What if you cannot update?

PHP 8.1 and earlier no longer receive fixes from the project. For 7.4, 8.0, and 8.1, source-code backports have been published, intended for those who compile on their own or are waiting for a vendor. CISA advises taking PHP-based systems that cannot be patched, or that run 8.1 or earlier, offline until they are updated.

Those who depend on a hosting provider, CMS, or distribution that has not yet delivered the patched package remain exposed. Contact the vendor and ask for a date.

Stopgap measures, which do not make the server secure:

• limit request size on the web server or proxy and keep post_max_size low;
• for CVE-2026-109618, set memory_limit=-1 so applications do not override it. Do not use RLIMIT_AS or RLIMIT_DATA;
• for CVE-2026-109619, set session.upload_progress.enabled=0 and restart the workers. On PHP 8.5, also set fatal_error_backtraces=0. This does not block all variants;
• a web application firewall (WAF) can provide some temporary protection, but there are reports of attackers changing payloads to bypass rules.

Is it being exploited?

The situation was still evolving on the evening of October 21, and sources differ.

• CISA reported no observed exploitation as of the alert's publication and advises applying the patch immediately.
• The PHP security team identified no working exploit before the release, but says the circulation of proofs of concept increased on October 21.
• Cloudflare reported initial exploitation attempts and attacks that changed payloads to bypass its firewall rules.
• watchTowr initially said it had observed no exploitation and, hours later, updated to active attempts against both CVEs.
• No source confirmed the successful compromise of a specific server, and the vulnerabilities were not in CISA's KEV catalog at the time of the coverage.

In practice: treat it as an imminent exploitation risk.

How to tell if there has been an attempt

Look for:

• unusual multipart requests followed by repeated memory-limit errors or HTTP 500s;
• abnormally large PHPSESSID cookies;
• unexplained worker restarts;
• PHP worker processes launching shells or downloading tools.

How it got here

On October 20, the CVE identifiers began circulating in forums and on social media, with a CVSS of 10.0 that the project did not confirm (the actual score is 9.2). PHP moved the disclosure from October 22 to October 21. According to the PHP Foundation, Calif mistakenly published a video with a proof of concept, later removed, and Chainguard published images with the patch before the agreed deadline. This sped up the work of those trying to reproduce the flaw. According to the coverage, Cloudflare activated WAF rules on the morning of October 21. Organizations such as BambooHR even took services offline as a precaution.

How Indene can help

We can help map where PHP runs in your environment (including embedded in other software), prioritize updates, and look for signs of exploitation attempts. [to be confirmed: contact channel and standard CTA]

Sources: PHP Foundation, CISA alert and The Hacker News.