PHP Patches Critical PHP2Shell Flaws as Exploitation Attempts Are Reported

Summary

PHP patched two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, that can enable unauthenticated RCE. Multiple firms reported exploitation attempts, though reports differed on their scale and no successful attempts were observed by WatchTowr.

Key points

The vulnerabilities are an out-of-memory corruption flaw and a stale global state flaw, each rated CVSS 9.2; RCE was confirmed on Apache with mod_php.
Patches are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with minimal source backports for PHP 7.4, 8.0, and 8.1.
The PHP Foundation says installations handling web requests may be affected, including PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed; the flaws affect releases back to PHP 5.4.
WatchTowr reported seeing exploitation attempts but no successful attempts on its sensors. Hadrian reported exploitation at scale, while Patchstack, Cloudflare, and Vega also observed attempts.
The flaws may also expose sensitive process memory, including credentials and API keys. The PHP Foundation says mitigations for unpatched systems reduce exposure but do not make them safe.
The article attributes discovery to Wiz, OpenAI, and Calif, and reports that leaked information and a prematurely published PoC video accelerated exploit development and prompted an early patch release.

Article Details

Vulnerability Types: Out-of-memory corruption
Stale global state
Memory-safety issues
Severity: Critical; CVSS 9.2
Affected Versions: PHP releases back to version 5.4 (nearly all releases)
Exploitation Status: reported
Exploit Availability: public_poc
Patch Status: available