PHP recently shipped an out-of-cycle emergency release fixing two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell. Both are rated 9.2 on CVSS v4.0 and can allow unauthenticated attackers to run code on vulnerable web servers. The release was moved up after details of the embargoed flaws leaked online, with early exploitation attempts and a public testing tool since reported.
What is the threat?
Both flaws are memory-handling bugs in PHP’s core engine, discovered by Wiz Research, OpenAI Codex Security and Calif.
CVE-2026-109618 abuses PHP’s out-of-memory handling. Crafted multipart form requests can exhaust memory, leaving request data partially initialized before shutdown acts on the invalid data. CVE-2026-109619 is a use-after-free flaw in which long-running workers retain stale references to freed memory, allowing data from one request to be accessed by a later request on the same worker.
Unauthenticated RCE over HTTP was validated against Apache mod_php with default limits, before application code runs. PHP-FPM is believed to be susceptible, although a full exploit has not been demonstrated.
Why is it noteworthy?
PHP powers a significant share of the web, and these flaws affect its core request-handling path rather than an optional extension. As a result, attackers can exploit the flaws without a login or application-level vulnerability.
The disclosure was also unusually chaotic. An anonymous Hacker News post on October 20 leaked the CVE IDs and an inflated CVSS 10.0 score. WatchTowr confirmed the leak was legitimate, prompting PHP to move up its release to limit the exposure window. Previous PHP vulnerabilities suggest attacks could follow quickly; when CVE-2024-4577 was disclosed in June 2024, Akamai observed exploitation attempts within 24 hours.
What is the exposure or risk?
Vendor estimates suggest more than 5.1 million PHP hosts are visible online, although this represents potentially exposed hosts, not confirmed vulnerable systems. Mallory counted approximately 884,000 internet-facing hosts advertising PHP 8.1 or older on October 20, about 59 percent of hosts reporting a version. These end-of-life branches receive no official fix and depend on distribution or LTS backports.
Successful exploitation can provide code execution in the web server context, potentially enabling web shells, data theft and lateral movement. PHP installations bundled within appliances, control panels such as cPanel and Plesk, and Windows software may also be overlooked during remediation.
Affected and fixed versions:
| PHP Branch | Affected Versions | Fixed Version | Status |
|---|---|---|---|
| 8.5 | Earlier than 8.5.12 | 8.5.12 | ✅ Patched |
| 8.4 | Earlier than 8.4.27 | 8.4.27 | ✅ Patched |
| 8.3 | Earlier than 8.3.36 | 8.3.36 | ✅ Patched |
| 8.2 | Earlier than 8.2.35 | 8.2.35 | ✅ Patched |
| 8.1 and older | All versions | No official fix | ⚠️ End of Life |
What are the recommendations?
Barracuda recommends the following actions to reduce risk:
Inventory & Patch
- Inventory every PHP installation.
- Prioritize internet-facing systems.
- Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- Restart PHP-FPM pools and Apache after updating.
- Confirm live workers are running the patched build. Updating the CLI package alone may not cover them.
If Patching Must Wait
- Set
memory_limit=-1. - Cap request and multipart sizes at the frontend.
- Avoid
RLIMIT_AS/RLIMIT_DATA. - Disable session upload progress.
- On 8.5, also disable
fatal_error_backtraces. - Isolate exposed applications or place a WAF or VPN in front of them.
- Include end-of-life servers in mitigation efforts.
Detection
- Alert when
php-fpm,php-cgi,httpdorapache2spawns shells or download tools.
If compromise is found
- Isolate the host.
- Preserve logs.
- Hunt for web shells.
- Check for new web-root files, cron jobs and accounts.
References
For more information, review the following resources:
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert (The Hacker News)
- PHP Releases Emergency Patches for PHP2Shell Flaws Threatening Millions of Web Servers (Cyber Security News)
- PHP advisory for CVE-2026-109618
- PHP advisory for CVE-2026-109619
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
