PHP2Shell Flaws Enable Unauthenticated RCE on PHP Servers

Summary

PHP fixed two critical PHP2Shell use-after-free flaws (CVE-2026-109618/109619) enabling unauthenticated RCE via crafted requests. Details and PoCs circulated before fixes; patch versions and temporary mitigations are listed.

Key points

CVE-2026-109618 and CVE-2026-109619 are use-after-free flaws in PHP, each rated CVSS 4.0 9.2; crafted requests can trigger unauthenticated remote code execution, file reads or memory disclosure.
PHP installations serving web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed; the PHP project assessed mod_php as the highest risk.
Fixes were released October 21 for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP has no upstream fixes for 8.1 and older, though some limited source backports are available.
Technical details leaked October 20 and proof-of-concept code was reported public. Agencies reported no confirmed exploitation, while security vendors reported attempted exploitation in honeypot or customer telemetry.
After upgrading, administrators should restart PHP-FPM or Apache, inventory PHP versions actually used by web servers, and check embedded runtimes in containers, appliances and hosting platforms.
Interim measures include disabling session upload-progress tracking and OPcache, reviewing fatal-error backtrace settings, deploying vendor WAF rules, and restricting access; these steps do not fully fix the flaws.

Article Details

Vulnerability Types: Use-after-free
Severity: Critical (CVSS v4.0: 9.2)
Affected Versions: PHP 5.4.0 and later
Exploitation Status: reported
Exploit Availability: public_poc
Patch Status: partial
Workarounds: Disable session upload-progress tracking by setting session.upload_progress.enabled = 0.
Disable OPcache by setting opcache.enable = 0.
Disable fatal-error backtraces where enabled, following the PHP advisory for the exact setting.
Deploy a WAF rule covering the anomalous multipart and session traffic, and verify that it is in blocking mode.
Take unpatched systems offline or isolate internet-facing applications until fixes are applied and verified.
Restrict access to PHP applications that do not need to be public and run PHP workers with least privilege.
Enable SELinux or AppArmor on Linux where possible.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationUnauthenticated attackers can send crafted web requests to exploit vulnerable PHP runtimes serving web requests and achieve remote code execution.

CVE

CVE-2026-109618Patch now: CVE-2026-109618 and CVE-2026-109619 let unauthenticated attackers run code on web servers running PHP, and details were public before fixes shipped.CVE-2026-109619Patch now: CVE-2026-109618 and CVE-2026-109619 let unauthenticated attackers run code on web servers running PHP, and details were public before fixes shipped.

Vendors

Carbon BlackSymantec and Carbon Black products protect customers, and additional protections are in development. Our Protection Bulletin is updated as new protection information becomes available.SymantecSymantec and Carbon Black products protect customers, and additional protections are in development. Our Protection Bulletin is updated as new protection information becomes available.

Products