PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has issued emergency security patches addressing two critical remote code execution (RCE) vulnerabilities collectively dubbed “PHP2Shell.” Tracked as CVE-2026-109618 and CVE-2026-109619, these flaws carry a CVSS score of 9.2 and affect all PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed configurations.
The vulnerabilities were discovered by researchers from Calif, OpenAI, Wiz, and Quarkslab through an AI-assisted investigation process. CVE-2026-109618 involves out-of-memory (OOM) corruption that enables attackers to achieve remote code execution as the web worker account. CVE-2026-109619 stems from a stale global state vulnerability allowing unauthenticated heap use-after-free, memory disclosure, and remote code execution with web worker privileges. Both issues originate from core PHP memory management and error handling components—areas nearly every request touches—which explains both their severity and the difficulty of fixing them.
The PHP security team identified mod_php as the highest-risk configuration, demonstrating that an unauthenticated request can trigger the attack before any application code executes. The underlying problems stem from PHP potentially leaving memory in a corrupted state when a request ends abnormally.
Patching requires updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on your version. PHP 8.1 and earlier are end-of-life and no longer receive updates from the PHP project, though some distributions may provide backported fixes.
Exploitation attempts began before patch availability. Amazon reported initial probing activity on October 17, four days before public disclosure. On October 20, information leaked online, accelerating proof-of-concept exploit circulation. WatchTowr and Cloudflare observed attack traffic immediately after patch release, with attackers actively modifying payloads to bypass firewall rules. SecurityWeek noted exploitation attempts targeting PHP’s session upload-progress path at scale.
These vulnerabilities impact approximately 70% of websites worldwide, powering platforms like WordPress, Drupal, Joomla, and Wikipedia’s MediaWiki. CISA strongly urged immediate patching, particularly for internet-facing systems, recommending organizations take unpatched PHP-based systems offline temporarily. Multiple cybersecurity firms warn that while successful exploitation hasn’t been widely confirmed yet, the widespread nature of PHP makes this an imminent threat to global web infrastructure.
https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html