Blog
Loaded reed boat

[Security Alert] What You Need to Know About the “PHP2Shell” Vulnerability

Urgent Security Alert: What You Need to Know About the “PHP2Shell” Vulnerability
A massive shockwave hit the cybersecurity and web development communities this week with the early disclosure of “PHP2Shell.” Comprising two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, these flaws expose millions of web servers to unauthenticated Remote Code Execution (RCE). Originally scheduled for a coordinated release on October 22, 2026, a public leak forced the PHP Foundation and major distributors to push out emergency patches a day early.
If your infrastructure relies on PHP—whether that is a custom Laravel application, a WordPress blog, or enterprise CMS platforms like Drupal and Joomla—you need to act immediately.

Understanding PHP2Shell

PHP2Shell is not a flaw in a specific web application, plugin, or framework; it is a critical vulnerability within the PHP runtime itself. Security researchers have assigned both vulnerabilities a CVSS 4.0 severity score of 9.2 out of 10.
The two vulnerabilities operate differently but achieve the same devastating result:
  • CVE-2026-109618: An out-of-memory corruption bug.
  • CVE-2026-109619: A stale global state bug, primarily linked to how PHP handles session upload progress.
Because these flaws exist at the runtime level, attackers do not need authentication, and your application does not need to have poorly written code to be exploited. Threat actors simply need network access to send specially crafted malicious HTTP requests to the target system. Security firms are already reporting active exploitation attempts in the wild.

Who is Affected?

The scope of this vulnerability is staggering. The flaws reach back over a decade, affecting PHP versions as old as 5.4. If you are running an outdated, End-of-Life (EOL) version of PHP (such as PHP 7.4 or 8.1), you are highly vulnerable and will not receive direct security updates from the core PHP project.

How to Protect Your Infrastructure

Updating is the only guaranteed way to eliminate this threat. Workarounds will only close specific attack paths, leaving your server partially exposed. Here is the action plan you should follow:
1. Apply the Official Patches Immediately The PHP Foundation has released fixed runtime versions. You must update your servers to one of the following secure releases:
  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35
Note: After updating the package via your package manager (e.g., apt upgrade), you must restart your web server (Apache/Nginx) and PHP-FPM workers to ensure the patched runtime is loaded.
2. Check with LTS Vendors for EOL Systems: If you are running PHP 8.1 or older, you must rely on your Linux distribution (like Ubuntu ESM) or your long-term support vendor to backport the security fixes. Ubuntu has already released fixes for older distributions like Trusty (14.04) and Xenial (16.04) through their Expanded Security Maintenance (ESM) service.
3. Implement Interim Mitigations: If you absolutely cannot patch today, implement these stopgap measures to shrink your attack surface:
  • Disable Session Upload Progress: Set session.upload_progress.enabled = Off in your php.ini file and reload your services. This blocks the confirmed attack vector for CVE-2026-109619.
  • Deploy WAF Rules: Ensure your Web Application Firewall is set to blocking mode. Providers like Cloudflare and F5 have already rolled out dedicated signatures to detect and block PHP2Shell payloads.
  • Filter Multipart Requests: If your application does not require file uploads, block multipart/form-data requests at the edge.
Do not rely on security through obscurity; hiding your PHP version headers (expose_php = Off) will not stop an automated exploit script. Audit your environments, patch your servers, and monitor your logs for anomalous PHPSESSID cookies or unexplained PHP worker crashes today.

Keith is the founder of KMSecurity (Pty) Ltd. and a passionate security researcher with a storied career of helping clients all over the world become aware of the information security risks. Keith has worked for clients in Europe, the Americas and Asia and in that time gained experience assessing for clients from a plethora of industries and technologies. Keith’s experience renders him ready to tackle any application, network or organisation his clients need help with and is always eager to learn new environments. As a security researcher Keith has uncovered bugs in some prominent applications and services including Google Chrome Browser, various Google Services and components of the Mozilla web browser.

Related Posts

Back To Top