PHP Releases Fixes for Two PHP2Shell Flaws Enabling Unauthenticated Remote Code Execution

Summary

PHP has fixed two critical flaws that can enable unauthenticated remote code execution and memory disclosure. Qualys reports broad exposure in its dataset; upgrading is the complete fix, while configuration changes offer temporary risk reduction.

Key points

CVE-2026-109618 and CVE-2026-109619 each have a CVSS v4.0 score of 9.2 and can enable unauthenticated remote code execution.
The flaws involve out-of-memory corruption and stale request state leading to use-after-free; researchers also demonstrated unauthenticated disclosure of PHP worker memory.
PHP identifies web-serving deployments including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed as potentially at risk; exploitability depends on configuration and application behavior. Cloudflare has reported attack traffic targeting the flaws.
Fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier are outside regular upstream support, so affected installations may require vendor fixes or an upgrade.
PHP's temporary mitigations include disabling session upload progress and adjusting configuration and request limits. These reduce exposure to specific paths but do not replace patching; affected workers must be restarted.
In anonymized data from more than 10,000 customers, Qualys counted 167 million PHP package installations; among 156 million with known versions, 110 million were on end-of-life or end-of-support branches.
The article warns that public proof-of-concept scripts can tie up workers, write data to disk, or trigger vulnerable code paths; it recommends using them only in isolated labs.

Article Details

Vulnerability Types: Out-of-memory corruption leading to remote code execution
Use-after-free from stale global request state, with demonstrated remote code execution and memory disclosure
Severity: Critical; CVSS v4.0 9.2 for each vulnerability
Affected Versions: PHP 5.4–8.1 (upstream unsupported; distribution or support-vendor backports may vary)
PHP 8.2 before 8.2.35
PHP 8.3 before 8.3.36
PHP 8.4 before 8.4.27
PHP 8.5 before 8.5.12
Exploitation Status: reported
Exploit Availability: public_poc
Patch Status: partial
Workarounds: Set session.upload_progress.enabled=0 before request parsing and restart every PHP worker; this blocks the confirmed session paths.
On PHP 8.5, set fatal_error_backtraces=0 administratively and restart every worker; this blocks the confirmed fatal-backtrace path.
For PHP-FPM, consider setting pm.max_requests=1; the article notes this is optional and may have a performance cost.
For CVE-2026-109618, PHP recommends memory_limit=-1 as a temporary measure; the article cautions that this removes PHP's per-request memory cap and increases resource-exhaustion risk.
If a patched build cannot be deployed promptly, restrict public access or temporarily isolate the affected service.