Critical PHP Flaws Enable Unauthenticated Remote Code Execution; Exploitation Attempts Reported
Summary
Two critical PHP flaws enable unauthenticated remote code execution. WatchTowr reported in-the-wild attempts but no successful exploitation; affected supported PHP versions have patches, while older installations need an upgrade or backported fix.
Key points
- CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, allow remote code execution through memory corruption and stale global state, respectively; both received a CVSS v4.0 score of 9.2.
- Attackers can reportedly reach vulnerable servers over the network without an account or prior access.
- WatchTowr reported observing exploitation attempts, but said none had succeeded at the time of reporting.
- PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain fixes; older versions need upgrading to a supported branch or a backported fix.
- The flaws affect web-request-serving PHP installations across several configurations; the PHP Foundation identified Apache mod_php as highest risk.
- Session Upload Progress, enabled by default, provides one confirmed path to triggering the issue.
- Huntress recommended inventorying PHP installations, identifying end-of-life versions, and alerting on PHP workers launching shells, interpreters, or download tools.
Article Details
- Vulnerability Types
- Remote code execution via out-of-memory corruption
- Remote code execution via stale global state
- Severity
- Critical; CVSS v4.0 score 9.2
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Upgrade to a patched supported PHP version or apply a backported fix.
- Until patched, reduce exposure; PHP's security advisory describes actions to do so.
CVE
CVE-2026-109618These vulnerabilities, dubbed "php2shell" by some researchers, include CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 enables remote code execution (RCE) via out-of-memory corruption, and CVE-2026-109619 enablesCVE-2026-109619These vulnerabilities, dubbed "php2shell" by some researchers, include CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 enables remote code execution (RCE) via out-of-memory corruption, and CVE-2026-109619 enables
People
Jake KnottHead of threat intelligence for WatchTowr; said WatchTowr had observed exploitation attempts but none had succeeded at the time.John HammondSenior principal security researcher for Huntress; recommended inventorying PHP installations and alerting on PHP worker processes launching shells, interpreters, or download tools.Patrick MünchChief security officer at Mondoo; praised the PHP team's response and discussed the challenges of supporting open-source software.
Products
Log4j 2Indeed, the PHP2Shell flaws echo the Log4Shell vulnerability in Log4j 2 nearly five years ago, which similarly required the security industry to come together to collectively patch a major flaw in a popular open sourcePHPA pair of critical vulnerabilities tied to open source scripting language PHP appear to have significant consequences for much of the server infrastructure holding the Internet afloat.