php2shell: Two Critical PHP Flaws and What to Patch First

What are CVE-2026-109618 and CVE-2026-109619?

PHP released fixes on October 21, 2026 for two critical flaws that the community calls php2shell. The PHP security team rates both at CVSS v4.0 9.2 and says they can allow unauthenticated remote code execution.

CVE-2026-109618 is an out-of-memory bug. PHP uses longjmp() to abort a request when memory runs out. In some contexts, request memory is still reachable before it is fully initialized, so cleanup can treat invalid data as valid.

CVE-2026-109619 is a stale state bug. Request-owned state can remain published after the request heap is freed. A later operation on the same worker can then read that state before normal initialization resets it.

Sansec describes CVE-2026-109618 differently, as a use-after-free in PHP's upload-progress handler that can return freed worker memory in a PHPSESSID cookie. This article follows PHP's description.

Which PHP versions are affected and fixed?

Calif's technical writeup found the earliest affected code path in PHP 5.4.0. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

PHP does not publish official releases for end-of-life branches. The PHP security team published minimal source backports for PHP 7.4 through 8.1. If you run an older branch, ask your vendor for a patched package or plan a move to a supported release. Check the version of the PHP binary that serves requests on each host, because the package list and the running binary can differ after a partial upgrade.

Is php2shell being exploited?

There are signs of active exploitation. Amazon Threat Intelligence observed an exploitation attempt on October 17, four days before public disclosure. Amazon says php2shell is now being broadly exploited in the wild.

PHP takes a more cautious line. Its team inspected proof-of-concept code that appeared after the leak and did not identify any functional exploits at the time of release. Cloudflare reported early attacks at 07:43 UTC on October 21, before PHP's 14:00 UTC release. More attempts followed on October 21, with payloads and infrastructure that Amazon says suggest multiple actors. Amazon also says it is unclear whether any of the October 21 attempts would have succeeded against real-world systems. Sansec expects more: "We expect mass exploitation now that the patch and the writeups are public."

Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure. The practical reading is to treat October 17 as the start of the window. Amazon recommends starting investigations from at least that date, not from the disclosure date.

Which applications are exposed?

Calif showed that an attacker without a login can run code on Magento 2.4.9, WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS.

The list is a set of tested applications, not a full inventory. Sansec notes that the flaws sit in the PHP engine, so stores are exposed even when their own code is clean. Check every host that runs PHP, including staging sites and internal tools.

What should you do this week?

First, make an inventory of every host that serves PHP. Record the PHP version and how PHP runs on each host, whether PHP-FPM, Apache mod_php or php-cgi, because the risk differs by setup. Then update PHP to a fixed release, or install your vendor's patched package. Patching is the fix. The other steps reduce exposure while you patch.

If you cannot patch right away, Calif published two partial mitigations: turn off session upload progress and remove the memory cap. Sansec also reports a web server rule that blocks multipart/form-data requests, but that rule breaks file uploads, so place a test order or upload a product image after adding it.

If you must take a site offline, stop PHP-FPM and have your web server show a static maintenance page. The maintenance modes in Magento and WordPress do not help, because PHP parses each request before the application checks the maintenance flag.

Banyard warned that turning off session upload progress alone is not enough, so combine the settings with the other steps. Then review logs from October 17 onward, not only from October 21. Sansec says every known trigger is a multipart/form-data request, so start with requests that carry that content type and reach PHP. Look for unusual status codes on those requests, new files in upload or web directories, and processes started by the web server user that you do not recognize.

If you find a hit, treat the host as compromised. Rotate the secrets it holds, including database passwords, API keys and TLS private keys, because the memory leak can expose secrets from other requests.

What can an attacker reach?

Sansec reports that CVE-2026-109618 also leaks memory on its own, similar to Heartbleed. The handler runs before application code, so the leak does not depend on what your application does. That memory can contain passwords, session tokens, API keys and TLS private keys from other requests.

For an operator, this means the risk is not limited to the application that was attacked. Any secret that passes through the same PHP worker can be exposed, so rotate credentials on hosts that were reachable before you patched.

Where do the sources disagree?

Three points differ between sources. Sansec describes CVE-2026-109618 as an upload-progress use-after-free, while PHP calls it an out-of-memory bug. The PHP Foundation says the CVE identifiers that leaked before the release carried a CVSS score of 10.0, while the official rating is 9.2. Amazon and Sansec say exploitation is broad, while PHP had not identified functional exploits at release. Re-check these points as new reports arrive.

What do readers ask most about php2shell?

Does a clean application protect me?

No. The flaws are in the PHP engine, so stores running Magento, Shopware or WooCommerce are exposed even when their own code is clean.

Does turning off session upload progress fix the problem?

No. It is a partial mitigation. Banyard warned that it is not enough on its own, so update PHP.

Which PHP versions have a fix?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are the fixed releases. Branches 7.4 through 8.1 have minimal source backports, and older branches have no official release.