PHP has rolled out emergency security fixes addressing two critical vulnerabilities, labeled collectively as “PHP2Shell,” that threaten millions of web servers by allowing remote code execution without authentication. Labeled CVE-2026-109618 and CVE-2026-109619, both bugs score 9.2/10 on the CVSS 4.0 scale. Server administrators are urged to update immediately.
The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35—any earlier releases in those series are vulnerable. PHP 8.1 and older versions are no longer officially supported, though some vendors may have backported patches. If you’re running one of those older branches, you’ll need to check with your provider or plan to upgrade.
Description of the Flaws
CVE-2026-109618 stems from how PHP handles out-of-memory scenarios during web requests. Previously, when memory was exhausted, PHP used longjmp() to abruptly exit, leaving part of the request data uninitialized. Later shutdown routines could then act on this invalid data, enabling remote code execution. Multipart form inputs—especially ones with numerous or empty fields—or nested field names can exacerbate memory usage and trigger this flaw. Apache setups using mod_php are particularly exposed; PHP-FPM may also be vulnerable, but no full exploit has been proven in that environment yet.
CVE-2026-109619 involves leftover global state in long-running PHP workers. Under certain error conditions, memory from one request may not get cleared properly, and later requests handled by the same process could access stale data. Confirmed attack paths include fatal error handling, session upload progress tracking, and error reporting—with both mod_php and PHP-FPM affected depending on configuration and extensions in use.
Mitigations and Recommendations
The only full mitigation is upgrading to one of the patched versions and restarting all relevant PHP workers. After updating, it’s critical to ensure that both front-end and back-end components—Apache modules, PHP-FPM pools, etc.—are running the repaired code.
If updating immediately isn’t possible, there are stopgap measures. To address CVE-2026-109618, avoid using memory_limit = -1, limit multipart inputs and request sizes, and steer clear of certain resource limits that trigger allocation failures. For CVE-2026-109619, disabling fatal_error_backtraces and session upload progress helps reduce exposure—but only partially. These aren’t complete fixes and won’t eliminate all risk vectors.
Reports estimate over 5.1 million PHP hosts visible online may be exposed—but that’s exposure potential, not confirmed compromise. Administrators are advised to review logs, determine which worker processes serve live traffic, and verify which installations actually run vulnerable versions.
All told, this situation demands prompt action. Update to patched versions, restart services, and check every public‐facing PHP deployment.
In this case of PHP2Shell, the severity comes not only from the seriousness of the vulnerabilities, but from how common PHP remains as a backend language in web infrastructure. With mod_php, PHP-FPM, and a range of web server stacks in widespread use, even partial exposure can open doors for attackers. What to watch: how quickly vendors and hosting providers roll out the patches, whether any major exploits emerge in the wild, and whether earlier unsupported branches see backports to protect high-risk environments.
