PHP Releases Emergency Patches for Two Critical PHP2Shell RCE Flaws
Summary
PHP released fixes for two unauthenticated PHP2Shell RCE flaws, CVE-2026-109618 and CVE-2026-109619. Attacks were reportedly observed before patching; administrators should upgrade or apply limited temporary mitigations.
Key points
- The flaws affect PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.
- CVE-2026-109618 can exploit out-of-memory corruption for RCE; CVE-2026-109619 involves stale global state and can cause heap use-after-free, memory disclosure, and RCE.
- The PHP security team considers mod_php especially at risk, with an unauthenticated exploit demonstrated to run before application code.
- PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; users on PHP 7 or earlier should migrate to a fixed release.
- Cloudflare's CTO said the company had observed early attacks. Its WAF rules were temporary, and PHP said no mitigation fully blocks potential attacks.
- For systems that cannot be patched immediately, PHP outlined measures to reduce exposure, including configuration changes and restarting workers; these are not complete protection.
Article Details
- Vulnerability Types
- Remote code execution (RCE)
- Out-of-memory corruption
- Heap use-after-free
- Memory disclosure
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For CVE-2026-109618, set memory_limit=-1 in a way applications cannot override.
- For CVE-2026-109618, set a low post_max_size: 8M for applications that do not require uploads, or 32M if uploads are necessary.
- For CVE-2026-109618, use a container or cgroup limit as an availability boundary, preferably killing only the affected worker.
- For CVE-2026-109619, set session.upload_progress.enabled=0 and restart every worker.
- On PHP 8.5, set fatal_error_backtraces=0 and restart every worker; this blocks only the confirmed fatal backtrace path.
- Remove invalid or deprecated per-request settings that emit diagnostics before initialization.
- Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing, and cleanup.
MITRE ATT&CK
CVE
CVE-2026-109618The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.CVE-2026-109619The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.
People
CalifNamed among those who discovered the two vulnerabilities.Dane KnechtCloudflare CTO who said Cloudflare was observing early attacks targeting the vulnerabilities and described its WAF rules as temporary protection.Gina Peter BanyardPHP core developer who warned that mitigations would not fully block potential attacks.
Vendors
Products
ApacheOpenAI security researchers, and affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.FrankenPHPaffect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.LiteSpeedinstallations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.PHPPHP ships emergency patches for critical PHP2Shell flawsPHP-FPMand OpenAI security researchers, and affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.