PHP rushed out emergency patches for two critical flaws nicknamed PHP2Shell

The PHP project shipped emergency security releases on Oct. 21 to close two critical remote code execution holes, CVE-2026-109618 and CVE-2026-109619, which researchers have nicknamed PHP2Shell. Each carries a CVSS v4.0 score of 9.2 and can be triggered over the network by an unauthenticated request.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

Because the affected software is any PHP installation that serves web requests, the fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 landed with unusual urgency. Administrators who could not patch right away were handed a list of stopgap settings, and security officials in Britain told organizations to update or pull systems offline.

CVE-2026-109618 and the out-of-memory trap

The first flaw lives in how PHP reacts when it runs out of memory. According to the php-src advisory for CVE-2026-109618, the engine uses a longjmp() jump to bail out of an out-of-memory error. If the allocation fails while request memory is only partly initialized, PHP exits without fully accounting for the early exit, and the shutdown routine later reads or branches on that invalid state.

Attackers can trigger the condition with crafted multipart requests, for example ones with unlimited headers or many empty file fields. The advisory reports unauthenticated code execution as the web worker account, validated against mod_php with default settings. The fix replaces the jump with a delayed soft out-of-memory condition and an immediate hard exit at a higher memory threshold.

CVE-2026-109619 and the stale global state

The second flaw is subtler. The advisory for CVE-2026-109619, titled remote code execution via stale global state, explains that PHP keeps error, session, object and extension data that can still point at memory belonging to a previous request. In persistent workers that state is not always reset before the request’s memory is freed, so a later operation that runs before normal initialization reads dangling pointers and triggers a use-after-free.

A fatal error such as an out-of-memory failure or a timeout can leave the state behind, as can a nonfatal warning that repopulates error data after cleanup. The advisory names two confirmed paths, a PHP 8.5 fatal-error backtrace and a session upload-progress feature, and notes that exploitation needs a producer request and a consumer request handled by the same worker. The CVSS vector rates attack complexity as high, which is part of why the score stops at 9.2.

Who is exposed and how officials responded

The project’s security announcement on php.net says every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php, where a demonstrated exploit can fire before any application code runs. PHP 8.1 and older no longer receive upstream fixes, though the security team published minimal source backports for 7.4, 8.0 and 8.1. The 8.2 line reaches end of life on Dec. 31, 2026.

In its alert of Oct. 21, the United Kingdom’s National Cyber Security Centre told organizations to inventory every PHP installation starting with internet-facing systems, update, apply the PHP Foundation’s temporary mitigations if that is impossible, and consider taking a system offline if mitigations cannot be applied quickly. It also urged checking unpatched systems for signs of compromise and backdoors, and watching vendors whose appliances bundle PHP.

In BleepingComputer’s coverage of the release, PHP core developer Gina Peter Banyard said no mitigation for PHP2Shell would fully block potential attacks and that the official patches are the only permanent defense. Cloudflare chief technology officer Dane Knecht said the company had deployed web application firewall rules against known exploitation methods and was already seeing early attacks, while stressing that those protections are temporary.

Stopgaps for servers that cannot update yet

The interim guidance differs for each bug. For CVE-2026-109618, PHP suggests setting memory_limit to -1 through a locked configuration directive so applications cannot override it, capping post_max_size at 8M (or 32M where uploads are needed), and using a container or cgroup limit as an availability boundary. For CVE-2026-109619, it recommends disabling session upload progress, restarting every worker, and on PHP 8.5 turning off fatal-error backtraces.

None of these is a cure. The advisories both say updating is the only reliable fix, and hiding diagnostics with error-reporting settings does nothing for the stale-state bug. Operators who run PHP through a distribution or a long-term-support vendor should check for backported packages, because Linux distributions received the patches in advance. Teams on unsupported branches face a harder choice between the source backports and a migration they may have been putting off.

Both flaws stem from PHP leaving memory in a corrupted state when a request ends abnormally, a pattern that attackers can probe repeatedly on exposed servers. With early exploitation already reported on Oct. 21, the practical window for patching is measured in days, not quarters. Cloudflare’s temporary firewall rules and the project’s configuration changes can buy time, but the project, the British agency and the developers quoted all point to the same remedy: move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart the workers, and then verify that no unexpected files or accounts appeared while the servers were exposed.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.