PHP2Shell Flaws Make PHP Inventory and Patching Urgent

Summary

PHP says three vulnerabilities can enable unauthenticated RCE under affected conditions. It provides fixed releases for two PHP2Shell flaws and recommends temporarily disabling session upload progress for the follow-on issue while organizations inventory and patch PHP.

Key points

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution through flaws in PHP request handling.
PHP says installations serving web requests are at risk, with the highest risk in Apache configurations using mod_php.
Fixed releases for the two PHP2Shell flaws are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; vendor backports may address older branches.
PHP disclosed CVE-2026-115560 on October 23, 2026, a separate RCE issue under unusual session-handler settings when upload progress is enabled. PHP recommends temporarily disabling session.upload_progress.enabled until the complete fix is available.
Organizations are advised to inventory PHP runtimes—including those bundled in products—assign remediation owners, prioritize internet-facing systems, and monitor for suspicious activity.
If a system cannot be promptly remediated, the article relays UK NCSC advice to consider taking it offline until fully mitigated.

Article Details

Vulnerability Types: Remote code execution (RCE)
Out-of-memory handling error during cleanup of partially initialized data
Stale global state after its underlying memory has been freed
Severity: Critical
Exploitation Status: unknown
Exploit Availability: unknown
Patch Status: available
Workarounds: For CVE-2026-115560, temporarily disable session.upload_progress.enabled; PHP says this does not cover every affected path and recommends applying the complete fix when available.
If a system cannot be remediated promptly, consider taking it offline until fully mitigated.