Two critical vulnerabilities in the PHP runtime have triggered an urgent security response across the web application security community. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws can create conditions for unauthenticated remote code execution (RCE) on vulnerable PHP servers.
Collectively referred to as PHP2Shell, the vulnerabilities involve memory-management problems during PHP request processing and out-of-memory error handling. Under certain conditions, a remote attacker may be able to exploit these conditions to execute arbitrary code on the affected server.
The risk extends beyond websites developers know are built with PHP. Content management systems, business applications, containers, hosting platforms, and third-party software may include PHP components behind the scenes.
The PHP project has released patched versions for supported PHP branches. Organisations should identify their PHP deployments, prioritise internet-facing systems, apply the appropriate updates, and investigate suspicious activity.
Official guidance:
1. Vulnerability Overview
PHP is a widely used server-side programming language that powers websites, APIs, content management systems, and web-based business applications. Because PHP processes incoming requests on the server, a flaw in the runtime itself can have consequences that extend well beyond a single application.
| Detail | Information |
|---|---|
| CVE-2026-109618 | Critical PHP runtime vulnerability |
| CVE-2026-109619 | Critical PHP runtime vulnerability |
| Common name | PHP2Shell |
| Severity | Critical |
| CVSS version | CVSS v4.0 |
| CVSS score | 9.2 for each vulnerability |
| Primary security concern | Potential unauthenticated remote code execution |
| Root issue | Memory-management errors during request processing |
| Required action | Upgrade to a fixed PHP release or apply vendor-supported mitigation |
The two vulnerabilities are related, but they describe distinct failure conditions in PHP's internal request-handling logic. Both deserve attention because successful exploitation may compromise the security boundary between an external HTTP request and the server processing it.
2. CVE-2026-109618: Out-of-Memory Handling and Partially Initialised Request Data
CVE-2026-109618 concerns PHP's handling of an out-of-memory (OOM) condition while internal request data is only partially initialised.
During normal operation, PHP allocates and manages memory to process requests. When memory allocation fails, the runtime must handle the error safely and clean up any resources associated with the interrupted operation.
The problem arises when an out-of-memory condition interrupts request processing before internal data structures have been fully initialised. Subsequent cleanup logic may treat invalid or incomplete data as if it were valid.
This can create a memory-safety failure. Under the relevant conditions, the flaw may be exploitable to achieve remote code execution.
Why this matters
A runtime-level weakness can be especially serious because the vulnerable operation occurs inside the component responsible for processing requests. Security teams should not assume that application-level authentication or input validation alone eliminates the underlying risk.
Security impact: Potential remote code execution on an affected server, depending on the runtime configuration and exploitation conditions.
3. CVE-2026-109619: Stale Internal State After Memory Is Freed
CVE-2026-109619 involves request-owned internal state that can persist after the memory backing that state has been freed.
This is associated with a class of memory-safety problems commonly described as use-after-free. In a use-after-free condition, software may attempt to use memory or state after its valid lifetime has ended.
In this case, internal state left behind during request processing may be accessed by a later request handled by the same worker before normal initialisation resets it.
The consequences of a use-after-free bug depend on the surrounding implementation, memory layout, runtime behaviour, and attacker-controlled input. In a vulnerable PHP environment, this issue can contribute to conditions that may permit code execution.
Why this matters
Web servers frequently process multiple requests over long-running worker processes. A memory-management defect that affects request cleanup or subsequent processing can therefore create risks beyond the individual request that first triggered the problem.
Security impact: Potential memory corruption and remote code execution under applicable conditions.
4. How Could PHP2Shell Affect a Web Server?
At a high level, exploitation involves abusing the vulnerable request-processing behaviour rather than simply logging in to a website with stolen credentials.
A simplified risk sequence looks like this:
An attacker identifies an internet-accessible service running a vulnerable PHP runtime.
The attacker sends a crafted request designed to trigger the vulnerable memory-handling path.
PHP encounters the relevant error or invalid internal state.
If the runtime reaches an exploitable condition, the attacker may gain the ability to execute code on the server.
This is a conceptual explanation, not a working exploit procedure. Actual exploitability depends on PHP's version, server configuration, request-processing components, and other environmental factors.
A successful compromise could potentially allow an attacker to:
Access application secrets and environment variables.
Read or modify data accessible to the PHP process.
Alter website files or application code.
Establish persistence or launch additional malicious processes.
Attempt to move deeper into the hosting environment.
Disrupt services or use the compromised server for further attacks.
These are potential consequences of server-side code execution, not a claim that every affected installation will experience all of them.
5. Which PHP Versions Are Affected?
The published security guidance identifies a broad range of PHP versions as potentially affected. The PHP project has issued fixes for supported release branches.
Fixed PHP versions
| PHP branch | Fixed release |
|---|---|
| PHP 8.5.x | PHP 8.5.12 |
| PHP 8.4.x | PHP 8.4.27 |
| PHP 8.3.x | PHP 8.3.36 |
| PHP 8.2.x | PHP 8.2.35 |
Install the appropriate fixed release or a newer supported security release for your branch. Confirm the exact affected-version range and remediation instructions in the official PHP security advisory.
What about PHP 8.1 and older?
PHP 8.1 and earlier have reached end of life in the PHP project's standard release lifecycle and do not receive fixes for these issues from the PHP project. Some operating-system vendors and long-term-support providers may supply backported security fixes.
Do not assume an older version is protected simply because its version number has not changed. Check your distribution or hosting provider's security advisory and verify whether the specific fix has been applied. Where possible, migrate to a currently supported PHP branch.
6. Who Is at Risk?
Organisations should assess all deployments that use PHP to process web requests, including:
Websites and applications hosted on public-facing web servers.
PHP-FPM deployments.
Apache servers using
mod_php.PHP-CGI and FrankenPHP deployments.
LiteSpeed-based hosting environments.
Container images and Kubernetes workloads containing PHP.
Business applications, appliances, and third-party products that bundle a PHP runtime.
Development and staging systems that are reachable from untrusted networks.
The Canadian Centre for Cyber Security identifies internet-facing PHP servers and applications as a priority. Its advisory also highlights multiple PHP request-serving configurations.
Important: A product may contain a vulnerable PHP component even if PHP is not obvious to the application owner. Check vendor advisories and software inventories rather than relying exclusively on application names.
7. Immediate Remediation: What Security Teams Should Do
Step 1: Inventory PHP installations
Identify PHP versions across production servers, virtual machines, containers, hosting accounts, and application platforms. Include systems managed by third parties.
Example commands for Linux administrators:
php -vThis checks the PHP CLI version available in the current environment. It does not necessarily identify the version used by every web server, PHP-FPM pool, container, or hosted application.
For PHP-FPM environments, inspect the relevant service configuration and running processes. For containers, inspect the deployed image and rebuild or redeploy using a patched base image.
Step 2: Upgrade to a fixed release
Upgrade each affected installation to an appropriate fixed PHP release:
8.5.12 or later in the supported 8.5 branch.
8.4.27 or later in the supported 8.4 branch.
8.3.36 or later in the supported 8.3 branch.
8.2.35 or later in the supported 8.2 branch.
Use trusted package repositories, official PHP releases, or your hosting provider's supported update process. Validate the resulting runtime version after the change.
Step 3: Restart or redeploy affected services
Installing a package does not always mean every running worker is using the updated runtime. Restart or redeploy the relevant PHP-FPM services, web servers, containers, and application instances as required by your platform.
Verify that the active production processes use the patched runtime.
Step 4: Apply temporary mitigations if patching is delayed
If an immediate upgrade is not possible, consult the official PHP guidance and your platform vendor for supported temporary mitigations.
Where effective mitigation cannot be applied promptly, consider isolating the affected internet-facing application from public access until it can be secured. A web application firewall may provide an additional defensive layer, but it should not be treated as a substitute for patching.
Step 5: Check for signs of compromise
Because these vulnerabilities can potentially lead to code execution, remediation should include an assessment of whether the system was already compromised.
Review relevant evidence, including:
Web server and PHP-FPM logs.
Unexpected child processes launched by web server or PHP workers.
Unusual file changes in application directories.
Newly created scripts, scheduled tasks, or service entries.
Unexpected outbound network connections.
Suspicious authentication activity and access to sensitive files.
Container or endpoint detection alerts.
Preserve logs and other evidence before making changes that could destroy forensic information. Escalate suspected compromise to your incident response team.
8. Detection and Monitoring Recommendations
Security operations teams should prioritise telemetry from internet-facing PHP services and investigate activity that deviates from normal application behaviour.
Recommended monitoring includes:
Web server telemetry: Look for unusual request patterns, unexpected request sizes, malformed multipart requests, and repeated errors. These indicators are not unique to PHP2Shell and should be evaluated in context.
Process monitoring: Investigate web server or PHP worker processes launching shells, interpreters, download utilities, or other processes that are unusual for the application.
File integrity monitoring: Alert on unexpected changes to PHP files, web roots, application configuration, and startup scripts.
Network monitoring: Review unusual outbound connections from web application servers, especially destinations not associated with normal business operations.
Runtime and service health: Monitor repeated worker crashes, abnormal memory usage, and unusual error spikes. These events may indicate instability, but they are not proof of exploitation.
Avoid relying on a single indicator or a simple signature. Correlate HTTP logs, process events, file changes, and network activity to determine whether an event represents an attempted attack or a successful compromise.
9. Does a Web Application Firewall Solve the Problem?
A web application firewall (WAF) can help block suspicious requests and reduce exposure when appropriate rules are available. However, WAF coverage depends on the specific attack path, rule quality, deployment mode, and traffic routing.
A WAF does not repair the vulnerable PHP runtime. Requests may also reach the vulnerable service through alternate paths, internal networks, or configurations not covered by the WAF.
Recommended defensive order:
Patch the PHP runtime.
Verify that all active instances are running fixed versions.
Use a WAF and network restrictions as additional controls.
Review logs for suspicious activity before and after remediation.
Continue monitoring for vendor updates and new indicators.
10. Is PHP2Shell Being Exploited in the Wild?
The public disclosure of a critical vulnerability can quickly attract attention from security researchers and malicious actors. Reports surrounding PHP2Shell have raised concern about proof-of-concept material and possible exploitation attempts.
However, a proof of concept, an attempted attack, and a confirmed successful compromise are different things. Security teams should consult current advisories from trusted sources before making claims about the prevalence of exploitation.
Regardless of whether a particular attack has been confirmed against your environment, the potential impact and availability of security updates justify immediate remediation.
For continuing updates, monitor the UK NCSC, Canadian Centre for Cyber Security, and official PHP security announcements.
Conclusion: Patch PHP2Shell Before It Becomes a Server-Side Incident
CVE-2026-109618 and CVE-2026-109619 demonstrate why memory-safety issues in widely deployed runtime software deserve immediate attention. These critical PHP vulnerabilities can create conditions for unauthenticated remote code execution, putting internet-facing applications and the data they process at risk.
The most effective response is straightforward: find every affected PHP deployment, install the appropriate security fix, verify that running services are patched, and investigate signs of potential compromise.
Do not overlook legacy applications, container images, or third-party products that bundle PHP. A patch applied to one server does not protect every instance across an organisation.
For SOC teams, system administrators, developers, and security leaders, PHP2Shell is a reminder that application security starts with the runtime—and that vulnerability management must include discovery, remediation, verification, and monitoring.
Stay informed with SOCShield for practical vulnerability analysis, critical CVE updates, and actionable cybersecurity guidance.
References
UK National Cyber Security Centre — Critical security issue affecting PHP
Canadian Centre for Cyber Security — PHP critical vulnerability alert
Comments
Post a Comment