PHP2Shell Explained: CVE-2026-109618 and CVE-2026-109619 — Technical Details and Remediation
Understand PHP2Shell, two critical vulnerabilities in PHP that may allow unauthenticated remote code execution. Explore their impact, fixed versions, and practical remediation steps for WordPress websites, PHP-FPM servers, and Docker deployments.
These vulnerabilities affect the PHP runtime. Update the PHP installation actually serving your website, restart workers or replace containers, and verify the deployed package revision. Updating WordPress or plugins alone does not replace a vulnerable PHP runtime.
What Is PHP2Shell, and Why Does It Require Immediate Attention?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities involving PHP memory management and internal state. Both have a CVSS v4.0 score of 9.2. Fixes were released on October 21, 2026. Under suitable conditions, exploitation may enable unauthenticated remote code execution or disclosure of PHP worker memory. Potential consequences include exposed credentials, modified website files, and actions performed with the web process’s permissions. Because the flaws reside in the runtime, secure application code alone does not prevent exposure. Practical exploitability varies by deployment and application behavior; exposure does not establish that a website has already been compromised.
CVE-2026-109618: Memory Corruption During Out-of-Memory Handling
PHP enters an out-of-memory condition when an allocation cannot be satisfied. Its previous longjmp()-based handling could interrupt execution while request structures were only partially initialized. Cleanup might then operate on invalid state, causing memory corruption and potentially remote code execution. The issue is therefore broader than simply accepting large uploaded files. The patch changes OOM handling to defer interruption to a safe execution point or terminate the process immediately under the relevant hard-limit conditions.
CVE-2026-109619: Stale Request State and Use-After-Free
A PHP worker can process multiple requests over its lifetime. This vulnerability occurs when worker-level state still references memory belonging to a completed request after that memory has been freed. A subsequent request handled by the same worker may access the stale reference before initialization clears it, resulting in use-after-free, information disclosure, or code execution. Exploitation requires both a state-producing operation and a later consuming operation. Worker rotation may affect reliability, but it does not replace the complete state-reset patch.
Affected Deployments and Fixed PHP Versions
Review PHP deployments serving web requests, including Apache mod_php, PHP-FPM, CGI, FrankenPHP, and LiteSpeed. Attack conditions differ, so an Nginx and PHP-FPM deployment should not be assumed safe. The minimum fixed upstream releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Choose a compatible supported branch or a newer release containing the fixes. Distribution packages require separate verification. For example, Ubuntu lists 8.3.6-0ubuntu0.24.04.13 as fixed for Ubuntu 24.04. Its older upstream version number does not mean the vendor package lacks the patch.
How to Identify and Update PHP on a Server
Run php -v and php --ini to inspect CLI PHP, then identify the runtime serving the website through its server configuration, FPM pool, or hosting panel. CLI PHP may differ from web PHP. Back up the database, application files, and configuration, and record required extensions. For APT-managed PHP 8.3 FPM, run sudo apt update and inspect apt-cache policy php8.3-fpm. After confirming a patched candidate, use sudo apt install --only-upgrade php8.3-fpm php8.3-cli php8.3-common and update additional installed extensions as required. Validate with sudo php-fpm8.3 -t, then run sudo systemctl restart php8.3-fpm. Adjust names for your installation. For control panels such as aaPanel, verify every website’s assigned runtime. System package updates may not cover separately installed panel-managed PHP.
Updating PHP for Docker and WordPress Deployments
Updating PHP on a Docker host does not update the runtime inside containers. Select a patched base image or a vendor image confirmed to contain the fixes. For a custom service named php, a compatible Dockerfile could use FROM php:8.3.36-fpm. Rebuild with docker compose build --pull php, then replace the container using docker compose up -d --no-deps --force-recreate php. For a prebuilt image, update its tag, run docker compose pull php, and recreate the service. Verify with docker compose exec php php -v. Replace the service name as appropriate. WordPress deployments also require a hosting-runtime update. Updating WordPress core, themes, or plugins does not replace PHP. Test website rendering, authentication, forms, and uploads afterward.
Temporary Mitigations While Preparing the Update
Temporary configuration changes reduce specific attack paths but do not cover every variant. Updating remains the primary remediation. Official guidance includes disabling session.upload_progress.enabled and, on PHP 8.5, fatal_error_backtraces. Apply settings before request parsing and restart all workers; application-level ini_set() may execute too late. Restrict request sizes where practical and address attacker-reachable fatal errors or timeouts. Hiding error output does not repair unsafe internal state. The advisory also discusses memory_limit=-1 for certain OOM paths. Do not apply it without capacity planning and external memory controls: it removes PHP’s memory limit and does not eliminate all failure paths.
Post-Update Verification and Suspected Compromise
Verify patched runtimes across all servers, containers, and replicas, and confirm that old processes have exited. Test authentication, sessions, uploads, forms, and background jobs. Combine log review with checks for unexpected files, administrator accounts, and network activity. Missing errors do not prove safety, while an isolated OOM event or worker crash does not establish exploitation. If compromise is suspected, isolate affected assets, preserve logs and snapshots, investigate persistence, and rotate potentially exposed credentials from a clean environment. Installing a patch does not remove a backdoor introduced before the update.