PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) | Endor Labs

What it is

PHP2Shell is the name for two memory-safety flaws in the PHP core engine, CVE-2026-109618 and CVE-2026-109619. They allow unauthenticated remote code execution and disclosure of sensitive process memory. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

How it works

Errors during request processing can leave internal data in an invalid state or leave references to memory that has already been freed. Attackers use this to corrupt memory and run code. PHP's advisories split the issues into out-of-memory corruption and stale global state, and the prerequisites differ by deployment. The page does not give further technical detail.

Preconditions / Affected

The flaw is in the runtime, so patching a CMS or its plugins does not remove it. Wiz researchers demonstrated exploitation against WordPress, Drupal and Joomla. PHP rates Apache with mod_php as highest risk, because a demonstrated attack triggers before application code runs. PHP can also arrive through a base image or hosting provider, so the fix may depend on teams outside the application owner.

What to do

• Inventory PHP runtimes in containers, servers and managed hosting, and start with internet-exposed services.
• Upgrade to the patched release for your branch, or install a distribution package with a confirmed backported fix. For unsupported branches, check vendor guidance and plan a move to a supported version.
• For containers, pull a patched base image or update PHP in the layer that installs it. Then rebuild, test, replace running containers and verify the deployed runtime has the fix.
• If patching is delayed, restrict access or take the service offline. CERT-EU advised unpatched organizations to consider taking affected websites offline.
• Put a WAF in front of exposed services. Cloudflare deployed PHP2Shell rules on October 21, about nine hours before public disclosure. They are on by default on all WAF plans, including Free, through the Cloudflare Managed Free Ruleset and the Cloudflare Managed Ruleset. Paid-plan customers should confirm the managed ruleset is in block mode.

Endor Labs customers can use container scanning to find affected PHP versions in images. Its base image remediation compares the current image with a refreshed build, the next version and the latest version, showing which findings each option fixes or introduces. The page says to confirm the chosen candidate includes the PHP fix, then rebuild, redeploy and rescan.

Caveats

• PHP says configuration changes give only partial protection.
• Cloudflare reports that attackers are already mutating payloads to evade its rules, and it recommends patching even with the WAF on.
• Endor's container reachability helps prioritize but does not show whether a specific vulnerable function is exploitable. Endor recommends upgrading regardless of reachability.
• The page does not list the vulnerable version ranges in text (the affected-versions table is not in the fetched content) and does not describe the exploit mechanics in detail.