PHP2Shell (CVE-2026-109618 and CVE-2026-109619): The Critical PHP RCE Flaws and How to Defend

• PHP2Shell is not a product; it is the shared name for two critical RCE flaws in PHP core.
• CVE-2026-109618: RCE via memory corruption (OOM, Zend engine). CVE-2026-109619: RCE via stale global state; one attack path is tied to session.upload_progress.
• The PHP team released patches on October 21, 2026: 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• Patching comes first. Interim mitigations (disabling session.upload_progress, a WAF rule) are for when you cannot patch immediately — they are not a permanent fix.

What is PHP2Shell?

PHP2Shell is the name given to two separate security flaws in the core of the PHP language. Because the flaws are in PHP itself, a very broad surface is affected, including WordPress, Drupal, Joomla, and custom applications running on PHP. The most dangerous part is that the attack requires no authentication: the attacker does not need a valid user account.

A successful exploit gives the attacker remote code execution (RCE) on the server. From there, steps such as reading files, exfiltrating data, creating new users, and preparing the ground for ransomware can follow. This is why PHP2Shell is rated critical.

The two flaws: CVE-2026-109618 and CVE-2026-109619

The PHP project rates both flaws 9.2 (critical) on CVSS v4.0. The exploitation status changes by source and date. On October 23, 2026, CrowdStrike wrote that it saw only testing and unsuccessful attempts. On October 29, 2026, Palo Alto Networks Unit 42 reported active exploitation against PAN-OS management interfaces exposed to the internet. Do not delay the patch.

Affected and patched versions

• At risk: all PHP installations that serve web requests. This includes PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team considers the risk highest for mod_php.
• Patched versions (October 21, 2026): PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• PHP 8.1 and older are end of life (EOL) and receive no releases from the PHP project. The PHP security team published limited source backports for 7.4, 8.0, and 8.1. PHP 8.2 reaches EOL on December 31, 2026.
• Distribution packages follow a separate track. Debian and Ubuntu packages, for example, may backport the fix under a version number different from the upstream one.
• So check your own distribution's package version, not just the upstream number.

Priority 1: Patch

• Identify the running PHP version and how it runs (mod_php, PHP-FPM, CLI).
• Install your distribution's patched package, then restart PHP-FPM or the web server.
• Rebuild container images from a patched base image. If you patch only the running container, the image stays exposed.
• On servers hosting multiple PHP versions, update each one separately.
• If you are on an EOL version, plan a move to a supported release; source backports are only a temporary bridge.

Interim mitigations (a bridge before patching)

• CVE-2026-109618: Set memory_limit=-1 where applications cannot change it (for example, php_admin_value). This does not stop underlying allocation failures.
• CVE-2026-109618: Lower post_max_size. Use 8M with no file uploads and 32M with file uploads. Keep upload_max_filesize below post_max_size.
• Do not use RLIMIT_AS or RLIMIT_DATA. These limits can cause the vulnerable allocation failure. Use a container or cgroup limit instead.
• CVE-2026-109619: Set session.upload_progress.enabled=0 in php.ini, an FPM pool, or the server configuration (not ini_set() or FPM .user.ini), then restart all workers. This blocks the confirmed session paths, not other variants.
• CVE-2026-109619: On PHP 8.5, set fatal_error_backtraces=0 and restart all workers.
• Fix fatal errors and execution timeouts that an attacker can trigger.
• Set limits at the web server, proxy, or WAF for request size, field count, multipart part count, header count, and nesting depth. You can also limit multipart POST requests that contain PHP_SESSION_UPLOAD_PROGRESS.
• Test these measures in a staging environment first. The PHP team says they reduce exposure but do not make an installation safe.

A separate issue: CVE-2026-115560

The PHP team published a notice for this flaw on October 23, 2026. The October 21 releases do not fix it. It occurs only when an application sets session.serialize_handler to php_binary or php_serialize, changes it to php at runtime with ini_set(), and keeps session upload progress enabled. If you use this setup, set session.upload_progress.enabled=0. The PHP team said it will publish the full advisory with the next regular release.

Detection: how do you know if you were exploited?

Memory-corruption exploitation can cause the target process to crash and restart. Layered detection is recommended:

• Process behavior: The PHP-FPM or web server process launching a shell, a network scanner, or an encryption tool is a strong alarm.
• Crash and segfault logs: Sudden, repeated segfault/crash entries on the web server should be investigated.
• File integrity: Unexpected new or changed files in the web root should raise an alert.
• Access logs: Look for unusual multipart requests containing a PHP_SESSION_UPLOAD_PROGRESS field, and repeated short requests to unknown files.
• Outbound traffic: Unexpected external connections from the server can signal data exfiltration.

How Moftgate helps against this flaw

Moftgate is not a substitute for the patch; you must update PHP first. But the Moftgate endpoint agent continuously monitors process behavior and file changes on endpoints, including servers, which helps catch an exploitation attempt early. The PHP-FPM process launching an abnormal command, or an unexpected file written to the web root, raises an alert in the central console. Built-in WORM backup keeps an immutable copy of data if the attack reaches the ransomware stage. The DLP engine blocks the exit if the attacker tries to move data out using the access they gained.