PHP Issues Emergency Patches for Critical 'PHP2Shell' RCE Flaws

The PHP security team has released emergency updates to address two critical remote code execution (RCE) vulnerabilities collectively tracked as PHP2Shell. The flaws, designated CVE-2026-109618 and CVE-2026-109619, affect the PHP runtime engine itself rather than third-party application code, leaving servers exposed even if individual websites and applications are securely built.

Both vulnerabilities carry a CVSS v4.0 severity score of 9.2 and impact nearly all PHP versions released since PHP 5.4. The emergency fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Understanding the PHP2Shell Vulnerabilities

Discovered by researchers at Wiz, Calif, and OpenAI—with assistance from Google's Gemini team—the flaws reside deep within the PHP runtime architecture. According to the PHP security advisory, every PHP installation serving web requests is potentially at risk, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.

Servers utilizing Apache's mod_php face the highest risk. In configurations using mod_php, a working exploit can trigger an attack via a single unauthenticated request before any application code executes. The vulnerabilities also allow attackers to read live memory from the PHP worker process directly, potentially exposing sensitive data such as passwords, authentication tokens, API keys, and certificates belonging to concurrent requests without requiring prior code execution.

Researchers noted that artificial intelligence models aided in developing the exploits, compressing a process that might have taken a human team months down to about a week. The underlying code issues had reportedly existed within the PHP repository for over a decade, with early warning signs initially flagged during an external security audit in 2024.

Early Exploit Attempts and Global Response

The coordinated disclosure timeline was disrupted following an early leak on Hacker News and an accidental video post by research firm Calif, prompting PHP to accelerate its release schedule to October 21, 2026. Prior to the official patch availability, Cloudflare and watchTowr reported observing active scanning and early exploitation attempts targeting the flaws. Cloudflare noted that attackers actively modified payloads to bypass preliminary web application firewall rules.

In response to the risk, several organizations temporarily took public-facing services offline as a precautionary measure. In the Netherlands, government portals including MijnOverheid and DigiD, alongside the national cyber-security center and the lower house of parliament website, experienced temporary outages. Private sector platforms such as BambooHR also reported taking services offline across North America and Europe while evaluating the threat.

Practical Implications and Mitigation

Administrators must note that updating application frameworks such as WordPress, Laravel, or Drupal does not patch the underlying vulnerability; the PHP runtime package itself must be updated through the server operating system, container image, or host provider.

• Official Fix: Upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 is the only complete and permanent remediation. Long-term support vendors and Linux distributions have received advance patches, meaning package version numbers may appear older while backporting the fix. Administrators should check package changelogs for CVE references.
• Unsupported Versions: PHP 8.1 and older no longer receive official updates, though source backports have been published for PHP 7.4, 8.0, and 8.1.
• Temporary Mitigations: Configuration adjustments—such as setting `memory_limit=-1` and low `post_max_size` for CVE-2026-109618, or disabling `session.upload_progress.enabled` for CVE-2026-109619—reduce exposure to specific attack vectors but do not fully secure a vulnerable server.

Readers can verify official details and review direct technical guidance by reading the original report on [The Hacker News](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html).