CVE-2026-109618 & CVE-2026-109619: PHP2Shell-critical Unauthenticated RCE in PHP Runtime

Impacted systems

Exploitation conditions

Both vulnerabilities can be exploited remotely without authentication when an attacker can send requests to an affected PHP runtime. CVE-2026-109618 involves memory corruption associated with out-of-memory handling and incompletely initialized internal request data. CVE-2026-109619 involves stale internal state that can survive request cleanup and be reused by a subsequent request handled by the same worker. Depending on the vulnerability, runtime configuration and application behavior, exploitation can result in arbitrary code execution, memory disclosure, worker crashes or service disruption. Apache mod_php has demonstrated particularly high risk because exploitation can occur before application code executes. PHP-FPM and other server integrations must also be assessed. Exploitation of both CVEs in the wild has been reported by watchTowr, while CrowdStrike reported no successful exploitation in its observed environments as of 23 October 2026. Treat internet-facing vulnerable systems as high priority even where successful exploitation has not been observed locally.

Recommended action

• Inventory all PHP installations, prioritising internet-facing systems, web servers, containers, managed hosting environments and embedded PHP appliances. Identify the actual runtime serving requests rather than relying solely on the command-line PHP version.
• Upgrade supported PHP branches immediately to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, as applicable, or to a later verified security release. Confirm that operating-system and hosting-provider packages include the fixes.
• For PHP 8.1, 8.0 and 7.4, apply a verified distribution or LTS vendor backport, use the applicable PHP security source backport, or migrate to a supported branch. For older unsupported branches, upgrade or isolate the system until a reliable fix is available.
• Restart PHP-FPM pools, Apache processes and other affected PHP workers after updating. Rebuild container images using patched base images and redeploy them so vulnerable runtimes are not left running.
• Preserve relevant PHP, web server, reverse proxy, EDR and network logs before making disruptive changes. Review unusual multipart requests, memory-limit failures, PHP worker crashes, unexpected child processes, suspicious file writes and unexplained outbound connections.
• Inspect potentially exposed systems for web shells, modified application files, unexpected scheduled tasks, persistence mechanisms, unauthorised accounts and suspicious access to secrets. Escalate suspected compromise to incident response and investigate before returning systems to service.
• If compromise is suspected or confirmed, isolate affected systems, preserve forensic evidence, remove persistence, rotate credentials and tokens accessible to the compromised runtime, and validate recovery before restoring connectivity.
• Verify remediation across all hosts and runtime pools using authenticated vulnerability scans, package inventories and deployment checks. Track unsupported instances and exceptions to closure.

Workarounds

• Temporarily disable PHP session upload-progress tracking where the feature is not required. Apply the setting before request parsing, for example in the effective php.ini, PHP-FPM pool or server configuration, then restart affected workers. This reduces exposure to a confirmed CVE-2026-109619 attack path but does not eliminate all exploitation paths.

  session.upload_progress.enabled = 0

• For PHP 8.5, disable fatal-error backtraces as a temporary mitigation for the confirmed fatal-backtrace attack path, where supported. Restart affected workers after changing the setting. This does not address every vulnerability path.

  fatal_error_backtraces = 0

• Reduce the likelihood of attacker-controlled memory exhaustion by enforcing appropriate request-body and multipart upload limits at the reverse proxy or web server, setting PHP post_max_size according to application requirements, and reviewing memory-limit configuration against the official PHP advisory. These controls reduce specific attack opportunities but cannot guarantee safety.

  post_max_size = 8M

• Restrict public access to vulnerable PHP services that do not need to be internet-facing. If a critical system cannot be patched or adequately isolated, consider taking it offline until remediation is possible.

• Use maintained WAF or reverse-proxy rules designed for PHP2Shell where available, and monitor for blocked and successful suspicious requests. Network filtering and runtime hardening are supplementary controls, not replacements for patching.

Sources

• PHP Security Advisory: Critical Remote Code Execution Vulnerabilities, Update Now ↗
• PHP2Shell: AI Uncovers Critical RCE Vulnerabilities Affecting 70% of the Internet ↗
• PHP Remote Code Execution (PHP2Shell): CVE-2026-109618 and CVE-2026-109619 ↗
• PHP2Shell: Obstacles to Weaponizing Likely Constrain Immediate Widespread Exploitation ↗
• PHP2Shell Vulnerabilities Allow Remote Code Execution in PHP Runtimes ↗