PHP2Shell Critical RCE: How to Patch CVE-2026-109618 & CVE-2026-109619 Now

On October 21, 2026, the PHP project released emergency security updates for two critical, unauthenticated remote code execution (RCE) vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively nicknamed “PHP2Shell.” Both carry a CVSS v4.0 score of 9.2 (Critical), and the U.S. National Security Agency (NSA) has advised organizations to either patch immediately or take vulnerable systems offline if an immediate update is not feasible.

This guide breaks down the vulnerabilities, the exact fixed versions, the verification scripts you can run, and the step-by-step commands to secure your servers.

What Are CVE-2026-109618 and CVE-2026-109619?

Both vulnerabilities are Use-After-Free (CWE-416) flaws in the PHP runtime itself, meaning they affect the engine that executes PHP code—not a specific application, plugin, or framework. An unauthenticated attacker can exploit either flaw to execute arbitrary code on the server without any credentials.

CVE	Nickname	Technical Root Cause
CVE-2026-109618	RCE via OOM corruption	When PHP runs out of memory mid-request, it can leave request memory half-initialized. The shutdown path then processes that invalid state as if it were valid.
CVE-2026-109619	RCE via stale global state	Request-owned internal state can survive after its backing memory is freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

The PHP security team confirmed that a demonstrated exploit exists against Apache with mod_php using default settings, allowing an unauthenticated request to trigger the attack before any application code runs.

READ ALSO:

Who Is Affected?

Every PHP installation serving web requests is potentially at risk, including:

PHP-FPM
Apache with mod_php (highest risk)
php-cgi
FrankenPHP
LiteSpeed

The vulnerabilities affect all PHP versions from PHP 5 onward, though official patches are only available for supported branches (8.2 and later)[reference:8][reference:9]. PHP 8.1 and older no longer receive official updates, but the PHP team has published source-only backports for PHP 7.4, 8.0, and 8.1 to help those building from source or without LTS vendor access.

Fixed PHP Versions (Patch Immediately)

The PHP project released the following patched versions on October 21, 2026:

PHP Branch	Affected Versions	Fixed Version
PHP 8.5	8.5.0 – 8.5.11	8.5.12
PHP 8.4	8.4.0 – 8.4.26	8.4.27
PHP 8.3	8.3.0 – 8.3.35	8.3.36
PHP 8.2	8.2.0 – 8.2.34	8.2.35

Source downloads are available on the official PHP downloads page, and Linux distributions have received the patches in advance—check your vendor for updated packages.

The NSA Warning: Patch or Go Offline

The U.S. National Security Agency issued an urgent directive on October 21, 2026, advising organizations to either apply the patches immediately or disconnect vulnerable systems from the network if an immediate update is not feasible.

“These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline.” — U.S. National Security Agency

The UK’s National Cyber Security Centre (NCSC-UK) and CERT-EU issued similar guidance, with CERT-EU recommending that organizations isolate internet-facing applications from public networks until a fix can be applied[reference:15]. Several government websites in Europe, including portals in France and Belgium, were taken offline as a precautionary measure.

Cloudflare CTO Dane Knecht warned: “We are seeing early attacks emerging and are updating mitigations as new vectors show up”.

How to Verify If Your Server Is Patched (Detection Scripts)

Because Linux distributions often backport security fixes without changing the upstream version string, running php -v alone is not enough. A patched Ubuntu box may still report “PHP 8.3.6” after applying the security update.

Method 1: Behavioural Check Script (Recommended)

The php2shell-check script safely verifies the patch by testing how PHP terminates when an 8 MiB memory limit is reached. It does not exploit the vulnerability or send HTTP requests.

# Download and run the check
git clone https://github.com/SamJUK/php2shell-check-cve-2026-109618.git
cd php2shell-check-cve-2026-109618
chmod +x check-php-security-fixes.sh
./check-php-security-fixes.sh

# Exit codes:
# 0 = Patched behaviour observed
# 1 = Old, unpatched bailout behaviour observed
# 2 = Inconclusive or PHP not found

Run it inside every PHP container or image you deploy. A check on the host does not inspect PHP inside containers.

docker exec -i CONTAINER bash -s < check-php-security-fixes.sh

Method 2: Passive Exposure Scanner

The php_vuln_scan.py script passively fingerprints PHP versions across your web hosts by sending ordinary GET requests—it never attempts to trigger the vulnerability.

git clone https://github.com/squiblyza/CVE-2026-109618-CVE-2026-109619.git
cd CVE-2026-109618-CVE-2026-109619

# Scan a single target
python3 php_vuln_scan.py -t https://example.com

# Scan multiple targets
python3 php_vuln_scan.py -t example.com -t https://shop.example.com

# Scan from a scope file (one host or URL per line)
python3 php_vuln_scan.py -f scope.txt

# If headers hide the version, use --probe
python3 php_vuln_scan.py -t https://example.com --probe

Method 3: Package Changelog Check (Ubuntu/Debian)

On Debian-based systems, the most convincing evidence is the package changelog:

# Check the changelog for the CVE patch
zcat /usr/share/doc/php8.3-common/changelog.Debian.gz | grep -c 'CVE-2026-109618'

# A count of 1 or more indicates the patch is present
# Check the actual package version
dpkg-query -W -f='${Package} ${Version}\n' php8.3-common

Ubuntu, for example, lists 8.3.6-0ubuntu0.24.04.13 as the fixed package version for 24.04, even though php -v still reports “8.3.6”.

Step-by-Step: How to Patch Your PHP Installation

Step 1: Update PHP Packages

# Ubuntu / Debian
sudo apt-get update
sudo apt-get install --only-upgrade 'php8.3-*'

# Or update all packages
sudo apt-get upgrade

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf update php*

# Alpine Linux
sudo apk upgrade php83

Alternatively, download the fixed source from the official PHP downloads page and compile it manually.

Step 2: Restart PHP and Your Web Server

Installing the update is not enough. You must restart the services so the patched binary is loaded into memory:

# Restart PHP-FPM (adjust version as needed)
sudo systemctl restart php8.3-fpm

# Restart Apache
sudo systemctl restart apache2

# Restart Nginx (if using PHP-FPM)
sudo systemctl restart nginx

# Restart LiteSpeed
sudo systemctl restart lsws

# For Docker containers, rebuild and redeploy the image
docker build -t my-php-app .
docker stop my-php-app && docker rm my-php-app
docker run -d --name my-php-app my-php-app

Step 3: Verify the Patch Is Active

Run the behavioural check script from the section above. A result of exit code 0 (patched behaviour observed) confirms the fix is active.

If You Cannot Patch Immediately: Temporary Mitigations

The PHP security team emphasizes that only an update is a complete solution. However, if patching is temporarily impossible, the following measures reduce exposure to specific attack paths but do not make an installation safe.

For CVE-2026-109618 (OOM Corruption)

Set memory_limit=-1 in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration. This removes the controllable PHP memory limit failure path[reference:27].
Set a low post_max_size: use post_max_size = 8M for applications that do not require file uploads, or post_max_size = 32M if uploads are necessary. Keep upload_max_filesize below post_max_size.

For CVE-2026-109619 (Stale Global State)

Disable session.upload_progress.enabled in php.ini. This blocks one demonstrated path for CVE-2026-109619 only and does nothing for CVE-2026-109618. It must be set in php.ini and cannot be changed at runtime.

Remember: These are stopgaps, not fixes. The NSA and PHP Foundation both stress that the only safe path is to patch.

Frequently Asked Questions (FAQ)

What is PHP2Shell?

PHP2Shell is the nickname for the pair of critical PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. They allow unauthenticated attackers to execute arbitrary code on PHP servers.

Which PHP versions are affected?

All PHP versions from PHP 5 onward are affected. Official patches exist for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and older are end-of-life and receive no official updates, though source-only backports are available.

Is WordPress affected?

WordPress itself is not the vulnerability. However, WordPress runs on PHP, so any WordPress site hosted on an unpatched PHP version is at risk. WordPress.org has stated that no WordPress update is required—you must update PHP.

Can I just disable a plugin or use a security plugin to fix this?

No. These vulnerabilities are in the PHP runtime, not in application code. Security plugins and WAFs cannot fully mitigate them. Only patching PHP or taking the system offline is a complete solution.

How do I know if my server is patched if `php -v` shows the old version?

Linux distributions often backport security fixes without changing the upstream version string. Check the package changelog (e.g., zcat /usr/share/doc/php8.3-common/changelog.Debian.gz | grep CVE-2026-109618) or run the behavioural check script from this guide.

What does the NSA recommend?

The NSA recommends applying the patches immediately or disconnecting vulnerable systems from the network until they can be fully mitigated.

Final Thoughts

The PHP2Shell vulnerabilities are among the most severe web security threats of 2026. With a CVSS score of 9.2, a public proof-of-concept exploit, and active exploitation already being observed, the window to act is narrow.

The fix is straightforward: update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restart your PHP service, and verify the patch with the detection scripts above. If you cannot patch immediately, take the system offline or apply the temporary mitigations—but do not delay.

Check every PHP installation you run: web servers, containers, CI/CD pipelines, and staging environments. The attacker only needs one unpatched endpoint.

Stay safe, and patch first.