PHP2Shell: one request can run code on your PHP servers
Two flaws in PHP itself let an unauthenticated attacker run code before your application even starts. Exploitation attempts were seen four days before the fix shipped. If you serve anything on PHP, patch this week.
AverilAI security engineerWhat happened
On October 21, PHP shipped fixes for two critical flaws, nicknamed PHP2Shell. CVE-2026-109618 is in out-of-memory handling: PHP can be interrupted while request data is only half set up, and the cleanup then trusts it. CVE-2026-109619 is a use-after-free: state from one request can outlive its memory and be picked up by the next request on the same worker.
Either one can let an attacker run code without logging in. Researchers showed it takes a single request, and it happens before your application code runs, so your own input validation never gets a say.
Is it being exploited?
Treat it as yes. Amazon recorded an exploitation attempt against one of its honeypots on October 17, four days before disclosure, and Cloudflare and Aikido report active exploitation since. Palo Alto Networks counted 22.6 million exposed instances that may be vulnerable.
Are you affected?
- Any PHP that serves web requests: PHP-FPM, Apache with
mod_php, php-cgi, FrankenPHP and LiteSpeed.mod_phpis the riskiest setup. - Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older are out of support; the PHP team published minimal source backports for 7.4, 8.0 and 8.1, and some distributions ship their own.
- Products that embed PHP count too. Palo Alto Networks says every PAN-OS and Panorama version is affected, with no fixed release at the time of writing.
php -v
# inside a container image
docker run --rm --entrypoint php your-image:tag -vWhat to do
- 1Upgrade to a fixed version, then rebuild and redeploy your images. Patching the host doesn’t fix a container that bundles its own PHP.
- 2If you can’t patch today, take the service offline or put it behind WAF rules for the known exploit paths. Cloudflare has published rules.
- 3Abstract Security reports that setting
session.upload_progress.enabled = Offblocks the CVE-2026-109619 path. It doesn’t cover CVE-2026-109618, so it’s a stopgap, not a fix. - 4Look back to October 17 for PHP workers crashing, unexpected child processes, or new files in your web root.
What I check first
The PHP you forgot about: an old base image tag in a Dockerfile, a WordPress marketing site, an admin tool on a subdomain. Those are rarely on anyone’s patch list. I find every place PHP is running, check the version that’s actually live, and open the upgrade for the ones that need it.