The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could allow attackers to execute code remotely on web servers without logging in. The fixes can be found in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the team strongly recommends that all PHP users should update immediately.
“These findings are among the most serious vulnerabilities discovered in PHP, and arguably in the history of the software. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the limit of what human researchers could practically achieve. Frontier AI models significantly reduced this barrier, turning a long-standing flaw into an exploit,” Wiz researchers explained.
Who is affected?
Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Configurations using mod_php face the greatest danger. A working exploit has already shown that a single unauthenticated request can trigger the attack before an application’s code is executed.
“The PHP situation is going to lead to a mass of incidents – it’s one of the biggest vulnerabilities in years,” noted security researcher Kevin Beaumont.
Vulnerabilities
CVE-2026-109618 – RCE via OOM corruption: managing the lack of memory can interrupt PHP while the internal query data is only partially initialized. Request cleanup can then treat invalid data as valid.
CVE-2026-109619 – RCE via obsolete global state: the internal state belonging to the query can survive after its backup memory has been freed. A subsequent request processed by the same worker may use this stale state before normal initialization resets it.
The UK’s National Cyber Security Center (NCSC) is urging organizations to consider taking any system offline that cannot be repaired immediately.
“So many embedded installations that will never be fixed. Too many forgotten and unmaintained applications. This one will have a long tail,” commented Hal Pomeranz, computer forensics expert.
How can you fix CVE-2026-109618 and CVE-2026-109619?
Updated to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Downloads are available here.
Vendors of Linux distributions and long-term support (LTS) obtained the patches before public release, so administrators should check with their vendor for updated packages.
The PHP project no longer supports PHP 8.1 and earlier. Some LTS distributions and vendors offer backported fixes, so users of these versions should contact their vendor or upgrade to a supported version.
Anyone who counts on rpms.remirepo.neta repository maintained by volunteers, it is advisable to switch to distribution packages or build PHP from source so that you can apply fixes immediately. The repository will not have any updates available today.
Due to the severity of the vulnerabilities, the PHP Security team has also released minimal source backports for PHP 7.4, 8.0, and 8.1. These are for people who are building from source or don’t have an LTS provider.
“The PHP sites behind Cloudflare already have an initial set of WAF rules deployed for known exploitation vectors in these vulnerabilities. The rules are available to all customers, including free of charge,” said Dane Knecht, CTO at Cloudflare.
Gn bussni
