PHP Patches Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
Summary
PHP issued emergency patches for two critical PHP2Shell flaws enabling unauthenticated code execution in affected runtimes. Cloudflare reported early exploit attempts, but no successful breach was confirmed; updating PHP is the complete fix.
Key points
- CVE-2026-109618 and CVE-2026-109619 affect PHP runtime versions dating back to PHP 5.4; both are rated 9.2 under CVSS v4.0.
- Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators should update the runtime and restart PHP workers and services.
- The flaws affect web-serving PHP installations across PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed; mod_php is identified as the highest-risk configuration.
- The flaws can enable remote code execution, and attackers may also read sensitive data in PHP worker memory, including passwords, tokens, API keys, and certificates.
- PHP configuration changes can reduce exposure to particular attack paths but are not complete fixes. Older unsupported branches require vendor packages or source backports where available.
- Cloudflare reported early exploit attempts before patches shipped, but the article says no successful break-in had been confirmed; some services went offline as a precaution.
Article Details
- Vulnerability Types
- Remote code execution
- Memory disclosure
- Severity
- Critical; both flaws are rated CVSS 9.2 (CVSS v4.0).
- Affected Versions
- PHP versions back to PHP 5.4 (nearly every version, according to the article)
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For CVE-2026-109618, set memory_limit=-1 so applications cannot override it, keep post_max_size low, and enforce request-size limits at the web server or proxy. The article warns that RLIMIT_AS and RLIMIT_DATA can trigger the same vulnerable path.
- For CVE-2026-109619, set session.upload_progress.enabled=0 and restart every worker; on PHP 8.5, also set fatal_error_backtraces=0. These settings reduce exposure to specific paths but do not fully mitigate the flaw.
MITRE ATT&CK
CVE
CVE-2026-109618Both flaws are rated 9.2 on the CVSS v4.0 scale and carry the identifiers CVE-2026-109618 and CVE-2026-109619. PHP published them around the scheduled release time of 14:00 UTC on October 21, a day after details leakedCVE-2026-109619Both flaws are rated 9.2 on the CVSS v4.0 scale and carry the identifiers CVE-2026-109618 and CVE-2026-109619. PHP published them around the scheduled release time of 14:00 UTC on October 21, a day after details leaked
People
Vendors
CloudflareBefore the patch shipped, Cloudflare said it was seeing early attempts to exploit the flaws. "We are seeing early attacks emerging and are updating mitigations as new vectors show up," Cloudflare CTO Dane Knecht said,OpenAIResearchers at Wiz, Calif, and OpenAI found and reported the flaws, which affect nearly every PHP version back to PHP 5.4.PHPPHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHPWizResearchers at Wiz, Calif, and OpenAI found and reported the flaws, which affect nearly every PHP version back to PHP 5.4.
Products
Apacheapplication, so a site is exposed even when its own code is secure. The risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code runs.FrankenPHPEvery PHP installation that serves web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, according to the PHP security advisory.LiteSpeedEvery PHP installation that serves web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, according to the PHP security advisory.PHPPHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHPPHP-FPMEvery PHP installation that serves web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, according to the PHP security advisory.
Tools
Codex SecurityThe flaws were found by Wiz Research, Calif, and OpenAI's Codex Security team, working with the PHP security team and Google's Gemini team on the fix. The underlying code had been in PHP for more than a decade.GeminiThe flaws were found by Wiz Research, Calif, and OpenAI's Codex Security team, working with the PHP security team and Google's Gemini team on the fix. The underlying code had been in PHP for more than a decade.
Countries
Canadarather than in response to any break-in. BambooHR took its service offline across the United States, Canada and Ireland, warned that payroll would be interrupted, and said it did not yet have a restoration time.Irelandthan in response to any break-in. BambooHR took its service offline across the United States, Canada and Ireland, warned that payroll would be interrupted, and said it did not yet have a restoration time.NetherlandsIn the Netherlands, MijnOverheid, DigiD, the lower house of parliament's site, the national cyber-security center and several education systems went offline, the broadcaster NOS reported; the centre said it had not seenUnited Statesas a precaution rather than in response to any break-in. BambooHR took its service offline across the United States, Canada and Ireland, warned that payroll would be interrupted, and said it did not yet have a