PHP2Shell: two flaws in the PHP core allow server takeover without login

Why this affects almost every PHP server

PHP2Shell covers two bugs in the PHP interpreter itself: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Since the problem sits in the engine, it makes no difference whether the server runs WordPress, a shop or a single form.

The first bug concerns out-of-memory handling: a request aborted at the wrong moment leaves half-initialized data that cleanup treats as valid. The second is a use-after-free: one request's state outlives its freed memory and a later request in the same process may use it. Either way, the attacker runs their own code as the account running the web server.

Who is really exposed

The vendor lists every installation serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

• Apache with mod_php: the PHP team demonstrated a working exploit. An unauthenticated request triggers it before any application code runs, so logins and in-app protections do not help.
• PHP-FPM and the other modes: the vulnerability follows from source analysis, and no complete exploit was demonstrated.
• PHP 8.1 and older: the PHP project no longer patches them. Some distributions and LTS vendors backport fixes, and the PHP team published minimal source patches for 7.4, 8.0 and 8.1.

Attacks started before the patch. Amazon Threat Intelligence, cited by BleepingComputer, saw the first attempts hit a honeypot on 17 October, four days before the fixes. How many succeeded is unknown. At the time of writing neither CVE is in the CISA KEV catalog.

Vulnerable and fixed versions

• PHP 8.5 before 8.5.12
• PHP 8.4 before 8.4.27
• PHP 8.3 before 8.3.36
• PHP 8.2 before 8.2.35

Distributions and LTS vendors got the patches early, so a lower-numbered package may already include the fix (backport). Compare the output of dpkg -l | grep php or rpm -qa | grep php with your distribution's security bulletin.

Order of work: today and in the next maintenance window

Today:

• every internet-facing server running PHP 8.2–8.5, starting with those using mod_php;
• internet-facing servers running PHP 8.1 or older: an LTS vendor package, the source patch, or at least the workarounds below. The UK NCSC advises updating or taking servers offline until patched.

In the next maintenance window:

• servers reachable only internally or over VPN, plus test and development environments;
• rebuilding Docker images and VM templates so new instances do not start on the old version;
• a plan to move off PHP 8.2, which reaches end of life on 31 December 2026.

Where an old version may be hiding

1. CLI and FPM versions can differ, so check both: php -v and php-fpm -v (the name depends on the distribution, e.g. php-fpm8.3 -v).
2. Whether Apache loads mod_php: apachectl -M | grep -i php.
3. Containers: docker ps, and in every container with PHP docker exec NAME php -v. Updating the host leaves PHP baked into images untouched.
4. The rpms.remirepo.net repository had no fixes on release day. The PHP team recommends distribution packages or building from source.
5. Shared hosting, vendor applications bundling their own PHP and forgotten machines from old projects. Ask your hosting provider directly for the version and update date.

If you cannot update right away

The vendor's workarounds reduce the risk but do not make the installation safe. They block the confirmed attack paths, not every variant.

• CVE-2026-109618: memory_limit=-1 locked so nothing overrides it (php_admin_value in the FPM pool or Apache configuration), post_max_size of 8M without file uploads or 32M with uploads, request size limits at the web server or proxy. Cap memory with a container or cgroup limit, never RLIMIT_AS or RLIMIT_DATA, which can themselves trigger the vulnerable allocation failure.
• CVE-2026-109619: session.upload_progress.enabled=0 in php.ini or the pool configuration, on PHP 8.5 also fatal_error_backtraces=0, then restart all workers. ini_set() or .user.ini is not enough.

What to look for in the logs

Attacks have run since 17 October, so for internet-facing servers patching alone does not close the matter. The vendor published no indicators of compromise. The bugs' mechanism shows where to look:

• web server logs: unusually large multipart requests, especially to pages with no upload form;
• PHP logs: bursts of “Allowed memory size exhausted” errors from a single source;
• PHP-FPM and Apache logs: workers exiting on a signal (e.g. SIGSEGV) and sudden restarts;
• disk: new or modified PHP files in web directories, e.g. find /var/www -name '*.php' -newermt 2026-10-17, and changes to the web server account's crontab.

If any of these is confirmed, treat the server as compromised: isolate it, preserve the logs, rebuild the system from a clean state and rotate the passwords and keys reachable from it.

The longer-term lesson

This time attacks preceded the patch, so the usual update cycle fell short. A company with a current inventory of servers, containers and PHP versions, plus a rehearsed same-day update, closes this in one afternoon. Without one, the first day goes on finding where PHP even runs. Prepare a plan for unsupported versions, such as PHP 8.2 from January, in advance.