PHP2Shell: the PHP remote code execution flaw already being exploited
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated code execution. What is known, who is affected and how to protect yourself.
· Josué Juca
- Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated code execution.
- They have been exploited on the internet since October 21 and are in CISA's KEV catalog.
- Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart the PHP processes.
- PHP 8.1 and earlier have no official fix: use a supported package or migrate.
- CVSS v4.0 score of both flaws
- 9.2
- PHP versions with an official fix
- 4
- start of observed exploitation
- Oct 21
On October 20, 2026, details of two serious PHP flaws leaked on social media ahead of the planned disclosure date. The PHP security team moved up an emergency release and, the next day, published the fixes. The set was nicknamed PHP2Shell, and exploitation has already been observed on the internet.
Since PHP runs a huge share of websites and web systems, it is worth understanding what happened and acting fast.
What the flaws are
They are two remote code execution (RCE) vulnerabilities that require no authentication:
- CVE-2026-109618: code execution through memory corruption. According to watchTowr's description, PHP runs out of memory partway through setting up a request and leaves internal data half built, which the cleanup code then trusts.
- CVE-2026-109619: code execution through stale global state. Internal state outlives the request memory it points to, and the next request handled by the same process can act on that leftover data.
According to watchTowr, both carry a CVSS v4.0 score of 9.2. Public descriptions are brief, and the sources we consulted do not mention public exploit code.
Who is affected
Every PHP installation that serves web requests is in scope: PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed and FrankenPHP. The highest risk is mod_php, where an attack can succeed before any of the application's own code has run. According to watchTowr, no configuration change fully mitigates the flaws.
Here is where each version stands:
| PHP version | Status | What to do |
|---|
| 8.5 | Fixed in 8.5.12 | Update |
| 8.4 | Fixed in 8.4.27 | Update |
| 8.3 | Fixed in 8.3.36 | Update |
| 8.2 | Fixed in 8.2.35 | Update |
| 7.4, 8.0 and 8.1 | Affected, no official fixed release | Distribution or extended-support package, PHP's minimal backports, or migrate |
| 7.3 and older (includes PHP 5) | Affected, unfixed | Migrate to a supported version |
Already being exploited
watchTowr observed exploitation attempts starting October 21, using its network of honeypots. On October 26, CISA added the flaws to its Known Exploited Vulnerabilities (KEV) catalog. No attribution has been made public so far.
What to do now
- Take inventory. PHP is often a component of other programs, such as websites, content management systems and panels, so it does not always show up at first glance.
- Update to the fixed version for your branch.
- Restart every PHP process (worker). Without a restart the fix does not take effect.
- Prioritize what is exposed to the internet, starting with servers running Apache and mod_php.
- If you cannot update right now, restrict internet access to those systems or take them offline until fixed. A web application firewall (WAF) can offer partial protection in the meantime.
- Monitor for PHP processes that open shells or download tools, signs that someone exploited the flaw.
For the inventory, start by checking the version on each server. PHP-FPM and the Apache module can differ from the command-line version:
php -v
php-fpm -v
No configuration solves it completely: the fix is to update PHP and restart the processes.
Timeline
- October 20: details leak ahead of the disclosure planned for the 22nd.
- October 21: PHP publishes the security advisory and fixed versions. watchTowr observes the first exploitation.
- October 26: CISA adds the flaws to the KEV catalog.
The flaws were discovered by researchers at Calif and reported to PHP through coordinated disclosure.
How we can help
If your company runs PHP websites or systems and needs to find where it is, update safely and keep an eye on the environment, our technical support and infrastructure team does that work.
Sources