Skip to content
HackIT
Talk to a tester

PHP2Shell (CVE-2026-109618): how to check your PHP servers

Two critical PHP flaws allow remote code execution without logging in, and are now exploited. Which versions are fixed, how to check yours, what to do today.

HackIT Security Team

Security alert cover for CVE-2026-109618 and CVE-2026-109619: CVSS 4.0 score 9.2, fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35

In short: Two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, let an attacker who is not logged in run code on a web server. PHP rates each 9.2 under CVSS 4.0, and CISA added both to its catalogue of known exploited vulnerabilities on 26 October 2026. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today.

What happened

On 21 October 2026, PHP published two security advisories and released fixes, according to CERT-EU's advisory. The flaws are in PHP, not in any one application, so every PHP site is in scope.

  • CVE-2026-109618, RCE via OOM corruption: when a request runs out of memory, PHP can leave request memory uninitialised and read it during clean-up.
  • CVE-2026-109619, RCE via stale global state: internal state can keep pointing at a request's memory after it has been freed, and a later request can use it.

For both, PHP states the confirmed impact as remote code execution without authentication, with the privileges of the web worker. CISA's alert puts it plainly: "These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP." On 26 October 2026, CISA added both to its Known Exploited Vulnerabilities catalogue.

Who is affected

PHP's advisories list as affected every release older than 8.2.35, 8.3.36, 8.4.27 and 8.5.12 in those four branches. According to CISA's alert, that covers every PHP installation that serves web requests: Apache with mod_php, which PHP considers the highest risk, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

PHP 8.1 and older no longer receive updates from the PHP project. CERT-EU notes that PHP has published minimal source fixes for 7.4, 8.0 and 8.1 for those who build from source, and that some distributions and long-term support vendors ship their own backported fixes.

PHP is also hidden inside other products. CISA warns that PHP is often a component of other software, so it may not show up where you expect.

A third flaw, CVE-2026-115560, was disclosed on 23 October. CERT-EU reports that it affects only unusually configured applications, that PHP considers it an unlikely risk, and that the fix will come with the next regular release; until then, CERT-EU's mitigation is to set session.upload_progress.enabled=0 and restart every worker.

How to check whether you are affected

Check the PHP that the web server runs, not only the one on the command line; on the same machine they can differ.

php -v
php-fpm -v

The FPM binary often carries the version in its name, such as php-fpm8.4. If the server uses mod_php, the Apache module's package is the one to check.

If PHP came from your Linux distribution, compare the package version with your distribution's security tracker rather than with PHP's version numbers: distributions received the patches in advance, and some ship the fixes as backports in their own packages. List the installed packages:

dpkg -l 'php*'
rpm -qa 'php*'

Debian, for example, lists the fix as php8.2 8.2.35-1deb12u1 for bookworm and php8.4 8.4.27-1deb13u1 for trixie. For containers, check the base image tag and rebuild on an updated image.

What to do now

  1. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your distribution's fixed package, internet-facing systems first. CISA also asks organisations to inventory every system running PHP, including inside other software.
  2. If you cannot update today, CISA advises taking PHP-based systems offline until they are patched, and CERT-EU suggests isolating internet-facing applications from public networks. For CVE-2026-109618, PHP's advisory names one partial measure: set memory_limit=-1 so that applications cannot override it, for example with php_admin_value in the FPM pool. PHP says this is not a complete mitigation. For CVE-2026-109619, it says updating is the only reliable one.
  3. Look for signs of compromise. CISA advises watching for PHP worker processes that launch shells or download tools.

Do not cap PHP's memory with RLIMIT_AS or RLIMIT_DATA: PHP's advisory warns that this triggers the vulnerable code path. And do not count on a web application firewall alone; CISA says only that one may give some protection until systems are updated.

What a penetration test would look for

A version check finds these two flaws. The harder question is what an attacker gets once code runs as the web worker: which files, secrets and databases that account can reach, and where it can go next. A web application penetration test looks at both the application and what sits behind it.

If you want to know what an attacker could reach from your web server, talk to a tester.

Sources

All posts