PHP2Shell: Two Vulnerabilities, One Serious Risk

PHP2Shell: Two Critical PHP Vulnerabilities You Need to Patch Now

Nearly 70% of websites with a known server-side language run on PHP. When a flaw like this appears, a lot of the web is exposed.

If your business depends on its website, a bug that lets attackers run their own code on your server can expose sensitive data, take services offline, and disrupt operations.

That is the concern behind PHP2Shell, a pair of critical PHP vulnerabilities disclosed on 21 October 2026. Both could let unauthenticated attackers execute code remotely on vulnerable installations.

What Is PHP2Shell?

➼ On 21 October 2026, the PHP project shipped emergency security updates for two critical flaws, now collectively called PHP2Shell.

➼ They are tracked as CVE-2026–109618 and CVE-2026–109619, and both score 9.2 (Critical) on CVSS v4.0.

➼ Both flaws relate to how PHP handles memory and internal request data. Under vulnerable deployment conditions, an attacker can exploit them with specially crafted requests, with no valid login required.

➼ The emergency release came after technical details were disclosed prematurely, which raised fears of exploitation before patches were ready.

CVE-2026–109618: RCE Through Out-of-Memory Corruption

➼ When PHP runs out of memory while processing a request, it can leave internal request data partially initialized.

➼ During cleanup, PHP may wrongly treat that incomplete data as valid, which can corrupt memory. Attackers can potentially turn this into remote code execution (RCE).

CVE-2026–109619: RCE Through Stale Global State

➼ Here, PHP holds on to references to memory that has already been freed. A PHP worker handling the next request may use those outdated references before its internal state is reset, creating a use-after-free condition.

➼ Attackers can potentially abuse this to corrupt memory and run malicious code.

➼ The root causes differ, but the outcome is the same: a compromised PHP installation.

How Could It Affect Your Business?

If exploited, PHP2Shell lets attackers run unauthorized code on your server. What that means in practice depends on your configuration, application privileges, and connected systems. Possible consequences include:

⚠️ Unauthorized system access: attackers can run commands and reach anything the compromised PHP process can reach.

⚠️ Sensitive data exposure: application data, database credentials, authentication tokens, and other secrets could leak.

⚠️ Website compromise: attackers could alter content, inject malicious code, or break functionality.

⚠️ Service disruption: exploitation could crash PHP processes and take your site offline.

⚠️ Wider compromise: a hijacked server can become a stepping stone to connected applications and internal systems, if permissions and network access allow.

These are potential outcomes of successful exploitation, not guaranteed results for every PHP site. Still, a vulnerable website can put more than the website itself at risk.

Is Your PHP Environment Secure?

Not every PHP website is vulnerable. Exposure depends on your PHP version, how PHP is deployed, and whether you've applied the latest patches.

Popular software such as WordPress, Laravel, and Nextcloud can be exposed if it runs on a vulnerable PHP installation. The flaws sit in the PHP environment, not in those applications.

You may be at risk if:

➟ Your PHP version is vulnerable: PHP 8.2, 8.3, 8.4, or 8.5 without the relevant fixes, or older unsupported versions without applicable backports.

➟ Your site is internet-facing: public PHP applications may be reachable by unauthenticated attackers.

➟ You use an affected deployment type: PHP-FPM, Apache mod_php, PHP-CGI, FrankenPHP, and LiteSpeed are among those affected.

Apache mod_php carries the highest reported risk.

Researchers have demonstrated an attack that works without authentication and triggers before any application code runs. Other deployments also need patching, though how exploitable they are varies with configuration.

Security researchers have already reported attack attempts, so patching exposed systems is urgent. To check your own exposure, review your PHP versions, deployment configuration, and patch status. A vulnerability assessment can help you find affected installations and prioritize the internet-facing ones.

Fixing PHP2Shell: A Step-by-Step Guide

Step 1: Find vulnerable installations.

Scan web servers, applications, cloud environments, and containers for PHP. Start with internet-facing systems, especially Apache mod_php.

Step 2: Upgrade to a patched version.

Apply the official security updates for your PHP branch:

➟ PHP 8.5: vulnerable 8.5.0–8.5.11 → fixed in 8.5.12

➟ PHP 8.4: vulnerable 8.4.0–8.4.26 → fixed in 8.4.27

➟ PHP 8.3: vulnerable 8.3.0–8.3.35 → fixed in 8.3.36

➟ PHP 8.2: vulnerable 8.2.0–8.2.34 → fixed in 8.2.35

PHP 8.1 and older have reached end of life and no longer get regular security updates from the PHP project. Some OS distributions and LTS vendors may backport fixes, so check with your OS, hosting, or PHP package vendor and plan a migration to a supported version.

Note that some Linux distributions backport patches while keeping the old version number. Verify against your vendor's security advisory rather than trusting the displayed version alone.

Step 3: Verify and check for compromise. After patching:

➟ Restart affected PHP services and workers.

➟ Confirm the running installation actually contains the fixes.

➟ Rescan to verify remediation.

➟ Review server logs and security alerts for suspicious activity or exploitation attempts.

🔸How to Check Your PHP Version and Deployment Type

1. Check your PHP version

On the server, run:

php -v

php -v

This prints the version, for example PHP 8.3.35. Compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Important: php -v shows the command-line PHP, which can differ from the PHP your website uses. To see what the website runs, use the next step.

2. Check what your website actually uses

Create a temporary file called info.php in your web folder: php

<?php phpinfo();

<?php phpinfo();

Open it in your browser. Look at two lines near the top:

• PHP Version is the version your site is running.
• Server API tells you the deployment type.

Delete the file straight afterward. The page exposes detailed server information.

3. Identify your deployment type

A shortcut without the full page: A file containing <?php echo PHP_VERSION . ' ' . php_sapi_name(); prints values like apache2handler (mod_php), fpm-fcgi (PHP-FPM), or cgi-fcgi.

4. Command-line checks for the server type

• Apache with mod_php: apache2ctl -M | grep -i php (on Red Hat-based systems, httpd -M | grep -i php). If it lists php_module or a similar name, PHP is running inside Apache.
• PHP-FPM: ps aux | grep php-fpm or systemctl status php*-fpm. Running processes mean FPM is in use.
• Docker: docker exec <container> php -v, and check the image tag. Images ending in -apache use mod_php.

5. Don't trust the version number alone

Some Linux distributions backport security fixes while keeping the old version number, so 8.3.35 may already be patched. Check your vendor's security advisory or the package changelog:

• Debian/Ubuntu: apt changelog php8.3-common
• Red Hat-based: rpm -q --changelog php | head

6. After you update

Restart PHP-FPM or Apache, then check the version again. A running process keeps using the old code until it is restarted.

🔸Can't Patch Right Now? Temporary Workarounds

If you can't patch immediately, you can reduce exposure with these stopgaps:

⤦ CVE-2026–109619: set session.upload_progress.enabled=0 in your PHP configuration and restart all affected workers.

⤦ CVE-2026–109618: set memory_limit=-1 at the server level, enforce strict HTTP request-size limits, and keep appropriate system-level memory safeguards in place.

⤦ Restrict public access and apply suitable WAF protections for extra risk reduction.

These are temporary mitigations, not fixes. Updating PHP is still essential.

Indicators of Compromise (IOCs)

Indicators of compromise are signs of possible malicious activity that help security teams spot and investigate attacks. For PHP2Shell, monitor web server logs, WAF alerts, and network traffic for reported attacker IPs, unusual HTTP POST requests, and unexpected PHP process behavior.

Reported suspicious IP addresses:

31(.)223(.)184(.)166, 37(.)19(.)200(.)5, 103(.)114(.)163(.)188, 103(.)216(.)220(.)92, 134(.)209(.)159(.)64, 54(.)154(.)150(.)2, 52(.)250(.)54(.)233, 223(.)160(.)160(.)11, 34(.)136(.)122(.)211, 20(.)200(.)234(.)181, 3(.)68(.)250(.)21, 184(.)73(.)151(.)236, 147(.)182(.)222(.)30, 94(.)154(.)43(.)7, 104(.)28(.)233(.)170, 114(.)26(.)103(.)72, 5(.)189(.)184(.)114, 51(.)143(.)62(.)244, 45(.)198(.)224(.)169, 85(.)11(.)167(.)243, 20(.)24(.)237(.)207, 46(.)101(.)229(.)142, 136(.)69(.)138(.)198, 77(.)109(.)105(.)177

These IPs are reported indicators and haven't all been independently verified as PHP2Shell-related. A match alone doesn't confirm compromise, so investigate it alongside suspicious requests and system activity.

🚨 Why Apache mod_php Is the Riskiest PHP2Shell Setup

Every PHP setup that serves web requests is affected by PHP2Shell, but one stands out. The PHP security team rates the risk highest for mod_php, with a demonstrated exploit in which an unauthenticated request can trigger the attack before any application code runs. Researchers also validated unauthenticated exploitation over HTTP against mod_php using PHP's default input and memory limits, so an attacker doesn't need an unusual configuration.

What does "before application code runs" mean?

Picture an office building. Your application (WordPress, Laravel, your custom code) is the reception desk. It checks IDs, asks for passwords, and turns away suspicious visitors. But before any visitor reaches reception, a mailroom at the front door unpacks every parcel, and that mailroom is PHP itself.

Every web request goes through roughly these stages:

1. The request arrives from the internet.
2. Apache hands it to PHP.
3. PHP's core engine unpacks the request: it reads headers, parses form and upload data, sets up sessions, and manages memory. This is where the PHP2Shell flaws live.
4. Your application code runs: login checks, input validation, security plugins.
5. A response goes back to the visitor.

The attack hits stage 3, so it is over before stage 4 begins. The attacker never has to log in, find a vulnerable plugin, or reach a particular page.

Why that makes your usual defenses ineffective

Most website security sits in stage 4 or later, so none of these protect you against PHP2Shell:

• strong passwords and multi-factor authentication
• application-level input validation
• WordPress security plugins
• "no public login page" setups
• a perfectly written, bug-free application

The flaw is in the PHP runtime beneath your application. That's also why configuration changes cannot fully mitigate the flaws, and why patching is the only permanent fix.

What makes mod_php different from other setups?

1. No separation between web server and PHP. With mod_php, PHP is built into the Apache process. The process that accepts the internet connection is the same one that runs PHP's engine, so there is no extra layer between them. With PHP-FPM, PHP runs as separate workers behind the web server.

2. Fewer checkpoints in front. In many FPM setups, a web server such as Nginx receives the request first and can filter or limit it before PHP sees it. With mod_php, the request goes straight into PHP's request handling.

3. A wider blast radius. A compromised mod_php process runs with Apache's account and can reach whatever that account can read. On shared servers, that can mean files for many sites. FPM can run each site in its own pool with its own user, which limits the damage.

4. Long-lived processes. Apache workers handle many requests over their lifetime. That matters for CVE-2026–109619, where leftover internal state from one request can affect the next.

5. Defaults. Exploitation was validated against default limits, so a "stock" setup is not a safe one.

Where mod_php is still common

• Official Docker images with the -apache tag
• Traditional LAMP-stack servers installed from distribution packages
• Older shared hosting and control-panel setups
• Small business and WordPress sites on default Apache installs

How to check if you use mod_php

On a Debian or Ubuntu server, you can check whether the PHP module is loaded in Apache:

apache2ctl -M | grep -i php

apache2ctl -M | grep -i php

If it prints php_module (or a versioned name like php8_module), PHP is running inside Apache. You can also create a temporary file containing <?php echo php_sapi_name(); and open it in your browser. apache2handler means mod_php, and fpm-fcgi means PHP-FPM. Delete the file straight afterward.

Other setups still need patching

mod_php is the worst case, not the only case. The Session Upload Progress feature, which is enabled by default, is among the confirmed attack paths, with code execution validated on both mod_php and PHP-FPM. PHP-CGI, FrankenPHP, and LiteSpeed are also affected.

What to do

1. Patch first. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, then restart Apache or PHP so the running processes pick up the fix.
2. Prioritize mod_php servers that face the internet.
3. Use a network-level WAF as a stopgap. It filters traffic before it reaches PHP. Cloudflare deployed WAF rules for PHP2Shell on October 21, about nine hours before public disclosure. A WAF reduces risk but doesn't replace the patch. endorlabs
4. Check Docker images. If you use php:*-apache images, rebuild them on a patched tag.

👀Understanding PHP2Shell: RCE, Out-of-Memory, and Use-After-Free

RCE (Remote Code Execution)

Plain English: An attacker, from anywhere on the internet, makes your server run commands they choose.

Technically: "Remote" means the attacker needs no physical or local access. "Code execution" means their instructions run on your machine, with the same permissions as the vulnerable program. For PHP, that's usually the web server account (such as www-data). From there an attacker may read files, steal database credentials, change your website, or use the server to attack other systems.

RCE is the worst outcome in vulnerability scoring. Combine it with "no login required" and you get a CVSS score of 9.2, as with PHP2Shell.

OOM (Out-of-Memory)

Plain English: The server runs out of working space in the middle of a task.

Technically: Memory (RAM) is where a program keeps the data it is currently working with. Each web request needs some. If the program asks for more than is available or allowed (for example, because of PHP's memory_limit setting), the request fails with an out-of-memory error.

Usually that's harmless: the request stops and the program cleans up. The danger comes from a bad moment. If the error hits while PHP is only partway through setting up a request, some of its internal data is left half-built. If cleanup code then treats that half-built data as complete, it can read or write the wrong places in memory. That is CVE-2026–109618.

Use-After-Free (UAF)

Plain English: A program keeps using a piece of memory after it has already given it back.

Technically: Programs request memory, use it, and then "free" it so it can be reused. A use-after-free bug happens when a pointer, which is a reference to that memory, is still used after the memory was freed. In the meantime, the space may have been reused for something else, possibly something an attacker influences. The program then reads or writes data that isn't what it expects.

In CVE-2026–109619, request-related internal state in PHP survives after the memory behind it was freed. The next request on the same worker can then touch that stale state before it is reset.

💭 How a memory bug becomes remote code execution

The two memory problems are the cause and RCE is the result. The link looks like this:

1. A memory bug (OOM mishandling or use-after-free) corrupts data inside the program.
2. The corrupted data includes things the program trusts, such as pointers or values that decide what runs next.
3. An attacker shapes the corruption with carefully crafted requests, so the program ends up following their instructions instead of its own.
4. That is RCE: the program has been steered into running attacker-chosen code.

Don't Panic,😟Just Patch: A PHP2Shell Checklist

Conclusion: Stay Ahead of PHP Security Threats

PHP2Shell is a reminder that the software beneath your website matters as much as the website itself. The fix is straightforward: find your PHP installs, apply the patches, restart your services, and check your logs. Every day an exposed server stays unpatched is a day attackers can use to get ahead of you.

🔐"You can't defend what you haven't found. Identify, patch, verify."