PHP2Shell: Critical PHP errors allow unauthenticated RCE; Patch now

The PHP project has sent emergency releases PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical flaws that can run an unauthenticated attacker’s code on a web server. Tracked as CVE-2026-109618 and CVE-2026-109619, and called “PHP2Shell” by the researchers, both bugs are rated 9.2 on CVSS v4.0. The security advisory from the team at php.net tells all PHP users to update immediately and says there will be no full downgrade.

Any PHP installation that serves web requests is affectedwhether it runs through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. PHP considers mod_php the riskiest setup, because a demonstrated exploit there can be triggered by a single unauthenticated request before any application code runs. So a vulnerable WordPress or Laravel site doesn’t need a plugin bug or a weak password to be taken over.

Attacks started before the fix

PHP posted an advance notice on October 20 saying the release would land on October 21 at 14:00 UTC, and reserved the right to ship earlier if details became public. According to Tenablethe CVE identifiers were already leaked before the release.

Amazon Threat Intelligence says its MadPot Honeypot reported an exploit attempt on October 17, four days before publication, from an IP address linked to a commercial anonymisation service. Tenable reports that Amazon now describes PHP2Shell as being widely exploited in the wild, and Cloudflare has pushed initial WAF rules for known exploit vectors. Code that claims to exploit the flaws is also circulating, although the PHP Foundation said it had not identified any functional public exploits at the time of publication.

The pool of exposed servers is huge. W3Techs puts PHP on 69.3% of websites whose server-side language is known.

What is broken in PHP

Both bugs come down to how PHP handles a request’s internal state in memory.

CVE-2026-109618 is an out of memory corruption bug. If PHP runs out of memory while a request’s internal data is only partially initialized, the OOM handler can interrupt it in the middle, and the cleanup request can then treat the half-constructed data as valid.

CVE-2026-109619 involving all global state. Internal state owned by a request may survive after the memory backed up has been freed. If the same worker then picks up another request, it can use that crazy state before normal initialization resets it.

Wizwhose researchers worked on the defects, they “among the worst vulnerabilities discovered in PHP, and probably in software history,” added that Frontier AI models “significantly reduced” the barrier to turning a long-standing bug into an exploit. The PHP Foundation credits Calif, OpenAI and Wiz, among others, for the research and responsible disclosure.

Distro packages and older PHP versions

Linux distributions and LTS vendors received the patches in advanceso most administrators check their distro’s security advisory and update PHP packages as soon as they land. An exception PHP calls out is the volunteer-run Remi repository (rpms.remirepo.net)widely used on Fedora- and RHEL-based servers, which said it would have no updates on release day.

PHP 8.1 and older will no longer receive updates from the PHP project. Due to the difficulty, however, the security team has published minimal source backports for PHP 7.4, 8.0 and 8.1 for people building from source or without an LTS vendor. Some distributions and long-term support vendors also ship their own backported fixes.

sites on PHP 8.2 sshould now patch and also plan the next move because this branch is reaching end of life December 31, 2026.

Stopgaps if you can’t update yet

PHP has listed temporary settings that block specific attack paths, while warning that none of them make an installation secure.

For CVE-2026-109618:

• Set memory_limit=-1 in a way applications cannot exceed.
• Set post_max_size to 8M (32M if you need to upload), keep upload_max_filesize below.
• Enforce request limits on the web server or proxy, and cap memory with a container or cgroup limit. PHP warns against using it RLIMIT_AS or RLIMIT_DATA for this, because they can cause the vulnerable allocation failure.

For CVE-2026-109619:

• Set session.upload_progress.enabled=0 in the php.inian FPM pool or server configuration that applies before parsing the request, then restarting all workers. Don’t rely on ini_set() or an FPM .user.ini file.
• On PHP 8.5, also set fatal_error_backtraces=0.
• Remove invalid per-request settings, and fix fatal errors and execution timeouts that attackers can achieve.