PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP released emergency runtime updates for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The patches fix two critical vulnerabilities that can allow an attacker with no account to execute code on a web server. Both flaws received a 9.2 CVSS v4.0 rating, indicating severe risk.

The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619. They sit inside the PHP engine, rather than inside applications such as WordPress or Laravel. That means a site can remain exposed even when its own application code is secure. The risk is particularly serious for Apache servers using mod_php.

Researchers at Wiz, Calif, and Axiom found and reported the flaws. They affect nearly every PHP version back to PHP 5.4. PHP published the fixes around 14:00 UTC on October 21, after details leaked before a planned October 22 disclosure. The PHP team says updating is the only complete protection.

A remote-code-execution vulnerability allows someone outside a server to cause that server to run code they supply. The code runs through a network request, rather than through approved administrative access. In PHP2Shell, the weakness is in PHP’s runtime, so the attack can reach the server before or independently of an application’s own logic.

The danger rises when no account is required. An attacker does not need a password, user registration, or a compromised application account. For example, the article describes a single unauthenticated request against Apache mod_php that can trigger the attack before application code runs. That creates a direct path from an exposed web service to code execution.

Code execution can allow much broader action than a normal web request. The attacker may be able to alter files, access data, or run other commands, although the article specifically confirms server-side code execution and memory exposure. PHP’s advisory says only fully updating the runtime protects the server.

PHP2Shell is unusually broad because the flaws affect the PHP runtime itself. Researchers found impact in nearly every PHP version reaching back to PHP 5.4. The exposure therefore does not depend on whether a site uses WordPress, Laravel, or a custom application. Even a simple Hello World page can be attacked when it runs on a vulnerable PHP version.

The PHP advisory lists every PHP installation that serves web requests as affected. This includes PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Apache mod_php is singled out as the highest-risk setup because a demonstrated exploit can trigger before application code runs. PHP-FPM handles early failures differently, but it is not automatically safe.

The broad distribution makes server-side inventory important. Administrators must update the PHP runtime serving requests and restart relevant processes. Older branches may need vendor packages or source backports. A distribution package can contain the fix under an old-looking version number, so its changelog should be checked for the CVEs.

Apache’s mod_php is considered especially exposed because PHP runs directly inside the Apache request path. The demonstrated exploit needs only one unauthenticated request and can trigger before the application starts. That means application-level defenses or secure application code may never get a chance to respond.

PHP-FPM behaves differently when a request fails early in setup. It shuts the worker down, which changes what an attacker can do through that path. However, the PHP analysis still considers FPM susceptible to one flaw, although no complete FPM exploit has been shown for it. The second flaw reached code execution on both mod_php and PHP-FPM, but its FPM route depends on an operation inside the application.

This difference affects attack mechanics, not the need to patch. FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed are all listed as affected web-serving setups. Administrators should update the PHP runtime and restart every relevant worker, rather than treating FPM as a complete defense.

The flaws can expose more than a route to code execution. An attacker may read memory from a PHP worker process without first taking full control. That memory can contain sensitive material left by other requests handled by the same worker, making the impact extend beyond the targeted application.

The article lists passwords, authentication tokens, API keys, and certificates as possible contents. Researchers demonstrated live worker-memory reading against applications they did not control. The result did not depend on the application running on top of PHP. This is important because a vulnerable runtime can expose secrets even when the application itself has no known flaw.

Code execution would create a more direct and powerful compromise path, especially on mod_php. Memory disclosure is still serious on its own because stolen credentials or tokens can support further attacks. After patching, administrators should review signs of earlier exploitation, including unusual multipart requests, memory-limit errors, repeated HTTP 500 responses, oversized PHPSESSID cookies, and unexplained worker restarts.

The PHP runtime is the component serving and processing web requests, and long-running processes may keep the old vulnerable code in memory. Therefore, administrators must update the server package or container image, then restart Apache, PHP-FPM, and other persistent PHP workers. Without those restarts, some requests may still reach an old worker.

Updating WordPress, Laravel, or another application changes the application, not the PHP runtime beneath it. Configuration workarounds are narrower still. For example, disabling session upload progress blocks confirmed paths for CVE-2026-109619, but not other variants. It does nothing for CVE-2026-109618. Other settings reduce request sizes or constrain memory but do not remove the flaws.

The PHP advisory explicitly says only updating fully protects a server. After patching, administrators should review memory_limit and post_max_size because the fix adds a hard memory limit. Older PHP branches may require vendor packages or source backports, and distribution changelogs should be checked for the CVEs.

A PHP runtime is the engine that interprets PHP and handles the work needed to process a web request. It sits beneath application code and is connected to the web-serving setup, such as Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed. The web server or related process passes a request into PHP, which then prepares and runs the application.

The article’s key point is that PHP2Shell lives in this engine, not in a site’s application. A request can therefore reach the vulnerable runtime before the application runs. With Apache mod_php, a demonstrated unauthenticated request triggers the attack before any application code executes. Even a simple Hello World page can be exposed if the underlying PHP version is vulnerable.

This layered design explains why application updates are insufficient. The application may be secure while the runtime remains vulnerable. Administrators must patch the PHP installation that serves requests and restart its workers. The same underlying risk spans every listed PHP web-serving setup, although each handles failed requests differently.