PHP2Shell: Two Critical PHP Flaws and How to Fix Them

PHP2Shell is the name given to two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, which PHP's maintainers disclosed on 21 October 2026. Each lets an attacker who is not logged in run code on a web server by sending web requests to it. The only complete fix is to update PHP to a patched version and restart the service.

What happened

PHP published security advisories and patched versions on 21 October 2026. Cloudflare says the details leaked before the planned release date. Three vendors report attacks. Amazon Threat Intelligence says its honeypot (a decoy server built to record attacks) saw an attempt on 17 October, four days before disclosure. watchTowr says its honeypots saw exploitation from 21 October. Cloudflare says it saw attack traffic against its customers, including payloads changed to get past its filters. We have not verified these reports ourselves.

The two flaws

Both flaws sit in how PHP handles one web request from start to finish. A PHP worker is the process that handles web requests one at a time and is reused for the next request.

• CVE-2026-109618, remote code execution (RCE, running an attacker's code on the server) through out-of-memory corruption: PHP uses a jump (longjmp()) to abandon a request when memory runs out. In some situations the request's memory can be reached before it is fully set up, so running out of memory there leaves invalid data that PHP then processes while shutting the request down
• CVE-2026-109619, RCE through stale global state: some request-owned data (errors, sessions, objects, extensions) can outlive the memory it points to, because a fatal error can skip the reset. Code that runs before the next request is initialized can then use that stale pointer, which is a use-after-free (using memory that has already been released)

Both advisories rate each flaw 9.2 out of 10 on CVSS v4.0 (the scoring system for vulnerability severity), with the same vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. In plain words: reachable over the network, no privileges and no user action needed, high impact on confidentiality, integrity and availability. The attack complexity is rated high. The advisories say the result is unauthenticated code execution as the web worker's account, not as an administrator. Qualys notes that success depends on factors such as memory layout and how workers are scheduled, so it varies by build and configuration.

Who is affected

The advisories list every PHP version older than the fixed release of its branch (8.2.35, 8.3.36, 8.4.27 or 8.5.12) as affected. Qualys and Help Net Security report that every PHP setup serving web requests is in scope: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php (PHP running inside the Apache web server) is described as the highest risk, because an attack can succeed before the application's own code runs. PHP-FPM (a separate pool of PHP workers) is not safe either: the advisory for CVE-2026-109619 says a code-execution case through the session feature was validated on both mod_php and PHP-FPM.

Older versions need separate attention:

• PHP 8.1 and earlier: no longer supported upstream. Help Net Security and Qualys report that PHP released limited source backports (the fix copied to an older version) for 7.4, 8.0 and 8.1, for people who build from source or have no long-term-support vendor
• PHP 7.3 and older, including PHP 5: watchTowr says these are affected and have no fix. This comes from one vendor, so confirm it for your own version
• Distribution packages: Linux distributions and long-term-support vendors may fix the flaw without changing the version number, so read the vendor's advisory instead of comparing numbers
• Products that bundle PHP: Help Net Security reported on 22 October 2026 that Palo Alto Networks lists all PAN-OS and Panorama versions as affected with no fixed release yet, while Fortinet and Cisco were still checking their products. This will change, so check each vendor's page

How to fix

Both advisories say updating PHP is the only complete fix. Cloudflare adds that the flaws are in the PHP runtime, so updating your website's code or plugins does not fix them. Update to the fixed version of your branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Steps:

• Find every PHP installation: start with internet-facing systems, and include containers, parallel PHP versions on one server, and appliances that bundle PHP. Qualys warns that php -v in a shell may show a different binary from the one serving web traffic
• Update the right package, binary or image: use the vendor's patched package, or rebuild the container image
• Restart every service that loads PHP: running workers keep the old code in memory until they are restarted or replaced
• Verify: confirm no worker still runs the old build, and restore any setting you changed temporarily (see the next section)

If you cannot update right away

The PHP advisories describe settings that reduce exposure, but they do not make an unpatched system safe. Treat them as a short-term measure with an owner and a deadline. The list below combines both advisories:

• For CVE-2026-109619, turn off session upload progress if it is not needed: set session.upload_progress.enabled=0 in php.ini, the PHP-FPM pool or the server configuration, then restart the workers. The advisory recommends this even after patching. Qualys notes that ini_set() and .user.ini are not enough
• For CVE-2026-109618, set memory_limit=-1 at the server level: this is the main setting PHP names, and it is not complete. It removes the memory ceiling, which raises the risk of a request using up all memory, so restore a finite limit after patching. Restart the workers and make sure no pool, directory or application setting puts a finite limit back
• Limit request size and block what you do not use: keep post_max_size conservative, enforce request size at the front-end proxy, and block multipart requests (the format used for file uploads) if the application does not use them
• Cap memory with the container or cgroup instead: PHP says to avoid RLIMIT_AS and RLIMIT_DATA, because they can trigger the vulnerable path
• On PHP 8.5, set fatal_error_backtraces=0: this removes the one confirmed trigger for CVE-2026-109619 and nothing more
• Set pm.max_requests=1 in PHP-FPM if performance allows: each worker then handles a single request before it is replaced, which removes the stale state the second flaw relies on
• Keep a web application firewall (WAF) on as an extra layer: Cloudflare says its managed rules protect customers by default, but attackers are already changing payloads, so a WAF supports patching and does not replace it
• If none of this is possible, restrict or take the system offline: restrict internet access to it, and the UK NCSC advises taking it offline until it is protected

Check whether you were already hit

Updating closes the hole but does not remove anything an attacker already left behind. The NCSC says that if you cannot update or take a system offline at once, check it for signs of compromise and backdoors first, and use an NCSC-assured incident response provider if you lack the skills. As of 22 October 2026, watchTowr says no public indicators of compromise (known traces of an attack) have been published. If a PHP server was reachable from the internet before it was patched, the points below are our own suggestions, not from the advisories.

• Look back to at least 17 October 2026: the earliest attempt reported so far, by Amazon, is dated then
• Review web server and PHP logs: look for unusual request bursts, repeated out-of-memory or fatal errors, and worker crashes
• Look for files that should not be there: new or changed .php files in web folders, especially upload folders
• Treat memory disclosure as possible: Qualys says an unauthenticated memory leak from a PHP worker can expose passwords, tokens and API keys, so rotate secrets that the application held if you suspect exposure

Common mistakes

• Updating plugins or site code and calling it done: the flaws are in the PHP runtime, not in the website
• Checking php -v and stopping there: the shell may show a different PHP from the one serving the site, and containers and appliances are missed
• Installing the update without restarting: running workers keep the vulnerable code until they restart
• Relying on a WAF alone: attackers are already adapting payloads to get past filters
• Assuming PHP-FPM is safe because only mod_php is named as the highest risk: the session-based code execution case was validated on PHP-FPM too
• Leaving memory_limit=-1 in place after patching: it removes the memory ceiling and raises the risk of a request using up all memory
• Treating PHP 8.1 or older as fine because it is not on the fixed-version list: those versions get no regular upstream fix, so they need a vendor package, a backport or an upgrade

Start today

• List every system that runs PHP, internet-facing first: ask each application owner and each vendor of a bundled product
• Find the PHP version and the way it runs (mod_php, PHP-FPM or other): check the binary that serves web traffic, not only the shell
• Schedule the update in the next maintenance window, or sooner for exposed systems: the flaws are being exploited, so treat them as emergency changes
• Apply the temporary settings only where the update must wait: write down who owns them and when they will be removed
• Check the vendor pages for appliances and hosted services you use
• Check CISA's Known Exploited Vulnerabilities catalog again: watchTowr noted that neither CVE was listed as of 22 October 2026, and that can change

For the wider routine behind this, see Patch Management: How to Keep Up Without Breaking Systems, Vulnerability Management: How to Build a Program That Works and CVSS, EPSS and KEV: How to Decide What to Fix First. To see where your organization stands today, try the self-assessment.

References and further reading

This is a fast-moving case, and this article reflects what was published up to 23 October 2026. Version lists, vendor status and exploitation reports change, so check the original documents again before acting. The advisories come from the PHP project; reports of attacks come from Amazon, watchTowr and Cloudflare, and we did not verify them. We did not test the flaws or the settings above. The advice on checking for compromise is our own view.

• PHP security advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618): the PHP project's advisory for the out-of-memory flaw, with affected and fixed versions and the settings that reduce exposure
• PHP security advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): the advisory for the stale global state flaw
• UK NCSC: Critical security issue affecting PHP: the national cyber agency's step-by-step advice
• Cloudflare: protections against php2shell: what its WAF covers, the attack traffic it saw, and why patching is still required
• Amazon Threat Intelligence: PHP2Shell exploitation before public disclosure: the report of the 17 October attempt
• Help Net Security: PHP2Shell, critical PHP vulnerabilities patched: a news summary with the backports and vendor updates
• Qualys: how to find, mitigate and patch PHP2Shell: detection and verification steps (the page may return an error to automated tools)
• watchTowr: PHP2Shell FAQ: affected branches, exploitation reports and the KEV status as of 22 October (the page may return an error to automated tools)
• CISA Known Exploited Vulnerabilities catalog: check whether the CVEs have been added