PHP has disclosed two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both have a reported CVSS v4.0 score of 9.2 and can potentially allow remote code execution without authentication. PHP says the risk is highest for Apache deployments using mod_php, where a demonstrated exploit may reach the vulnerable code before application code runs. PHP-FPM and other web-facing PHP runtimes also need attention. PHP’s security announcement lists the affected deployment types and fixed releases. (Source: PHP)

The vulnerabilities have been referred to as “PHP2Shell” in security coverage. This is not a separate PHP product or a standalone application vulnerability: the issue is in PHP itself. Organizations should treat all internet-facing PHP installations as candidates for investigation, then verify each runtime against the relevant upstream or vendor advisory.

What are the PHP2Shell vulnerabilities?

Both flaws concern PHP’s handling of internal request state and memory. At a high level, an error or a change in a request’s lifecycle can leave internal data in an unsafe state. Depending on the runtime, configuration, and application behavior, that may create a path to remote code execution.

• CVE-2026-109618 — out-of-memory corruption: An out-of-memory condition can interrupt an operation while request data is only partially initialized. Later cleanup may treat that incomplete state as valid.
• CVE-2026-109619 — stale global state: PHP may retain references to request data after the memory behind it has been freed. A later request handled by the same worker may access those stale references before they are reset.

PHP identifies web-serving installations—including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed—as potentially affected. Exposure can vary by configuration and application behavior, so do not assume that a particular PHP handler is safe without checking the applicable advisory.

Which PHP versions include the fixes?

The PHP project lists these fixed upstream versions for the currently supported branches:

If you install PHP through a Linux distribution, hosting provider, control panel, container image, or another software vendor, check that provider’s security advisory and package version. Vendors may backport a fix without changing the upstream version number to one shown above.

PHP 8.1 and earlier are outside regular upstream support. PHP says some distributions and long-term support vendors may provide backported fixes; check with your provider or plan an upgrade to a supported branch. The PHP project has also published limited source backports for PHP 7.4, 8.0 and 8.1. See the PHP announcement for details.

What should website owners and developers do?

1. Inventory every PHP runtime. Check production servers, staging environments, containers, hosting-panel installations, secondary application directories and PHP bundled with appliances or other software.
2. Identify the runtime serving each application. A command such as php -v may report the command-line PHP version, not the version used by a website. Check the web server, PHP-FPM pool, container or hosting environment that actually processes requests.
3. Apply the appropriate fixed package or build. Follow your distribution or hosting provider’s advisory where applicable; upstream version strings alone may not reflect vendor backports.
4. Restart or redeploy the affected runtime. Replace old PHP workers and redeploy containers or application images so that running processes use the patched build.
5. Verify remediation. Confirm the package or binary version, check the active web-facing runtime, and review any remaining PHP installations that may still be exposed.

For teams using vulnerability-management products, inventory and detection results can help prioritize exposed assets, but discovery is not the same as confirmation that a particular runtime is vulnerable. Validate findings against the correct PHP or vendor advisory and verify the running service after remediation.

Can you mitigate the risk without updating?

PHP’s guidance is clear: configuration changes are temporary risk-reduction measures, not a substitute for installing a fixed release. Some measures block specific known attack paths, but they do not cover every possible route to the vulnerabilities.

PHP recommends disabling session upload progress before request parsing to reduce exposure to confirmed paths associated with CVE-2026-109619. The setting must apply administratively—such as in php.ini, an FPM pool, or server configuration—and workers need to be restarted. Application-level ini_set() and FPM .user.ini are not the recommended way to apply this protection.

For CVE-2026-109618, PHP describes request-size and complexity limits as temporary measures. It also discusses setting memory_limit=-1 administratively to remove the attacker-controllable failure caused by PHP’s configured memory cap. This removes a per-request memory safeguard and can increase resource-exhaustion risk, so assess the operational impact carefully and do not treat it as a permanent fix.

Before changing production configuration, review PHP’s detailed advisory and test the change against your application and hosting setup. If you cannot patch promptly, consider restricting public access to the affected service or temporarily isolating it while you arrange remediation.

After patching: check for overlooked copies

Updating one PHP installation does not necessarily update every copy on a server. Older binaries may remain in custom application folders, secondary drives, container images, hosting-panel packages or appliance software. Record the location and version of each installation, then confirm that each application has moved to the fixed runtime.

Finally, review emergency configuration changes after the patched runtime is confirmed. Restore settings that were changed solely for temporary mitigation where appropriate, and test the application under realistic load before closing the incident.

Sources

• PHP security announcement and update guidance
• Qualys analysis: PHP2Shell vulnerabilities and remediation considerations