PHP2Shell Flaws Enable Unauthenticated Code Execution; Fixes Released

Summary

PHP2Shell comprises two PHP flaws enabling unauthenticated RCE. PHP released fixes for supported branches; Cloudflare says exploitation has begun. The article details affected versions, mitigations and post-patch checks.

Key points

PHP2Shell comprises CVE-2026-109618, involving out-of-memory request-data corruption, and CVE-2026-109619, involving stale global state.
Both flaws score 9.2 under CVSS v4.0 and can enable unauthenticated code execution on servers handling PHP requests. PHP reports a demonstrated exploit against Apache with mod_php before application code runs.
Cloudflare reports that exploitation has started. The article says independent researchers confirmed the flaws and PHP released fixes on October 21, 2026.
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; the article says all unpatched PHP versions serving web requests should be treated as affected.
Updating the runtime, restarting workers and rebuilding container images is the complete fix. Disabling session.upload_progress.enabled removes one confirmed attack path for CVE-2026-109619, but does not address every variant.
Memory and request-size limits can reduce exposure while patching is delayed, but are not a complete fix; the article warns against RLIMIT_AS and RLIMIT_DATA.
After patching, the article recommends checking for suspicious multipart requests, errors, malformed PHPSESSID cookies, unexpected files or processes, and rotating credentials if compromise is suspected.

Article Details

Vulnerability Types: Memory-safety vulnerabilities
Out-of-memory corruption
Stale global state
Severity: CVSS v4.0: 9.2 for each vulnerability
Affected Versions: PHP 8.5 versions before 8.5.12
PHP 8.4 versions before 8.4.27
PHP 8.3 versions before 8.3.36
PHP 8.2 versions before 8.2.35
PHP 8.1 and 8.0 (all releases)
PHP 7.0–7.4 (all releases)
PHP 5.5–5.6 (all releases)
Exploitation Status: reported
Exploit Availability: unknown
Patch Status: available
Workarounds: For CVE-2026-109619, set session.upload_progress.enabled=0 before request parsing and restart every worker.
On PHP 8.5, set fatal_error_backtraces=0 and restart every worker to block the confirmed backtrace path.
For CVE-2026-109618, set memory_limit=-1 in a way applications cannot override; the article warns that runaway requests may then exhaust the server.
Set a low post_max_size and enforce request-size and multipart limits at the web server or proxy.
If the application does not use multipart uploads, block multipart/form-data POST requests before they reach PHP.