PHP Remote Code Execution ("PHP2Shell" CVE-2026-109618 & CVE-2026-109619)

What it is

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws in PHP, each rated CVSS v4.0 9.2. The research was done by Calif, who published the full write-up. Details leaked on 20 October 2026, before the planned release. PHP published its advisory and fixed releases on 21 October 2026, and watchTowr's Attacker Eye honeypots saw exploitation of both CVEs the same day.

How it works

CVE-2026-109618 is out-of-memory corruption. PHP runs out of memory partway through setting up a request and leaves internal data half built, and cleanup code then trusts it.

CVE-2026-109619 is stale global state. Internal state outlives the request memory it points to, so the next request handled by the same PHP worker can act on leftover data.

Neither needs an account or prior access, only network reach to the server.

Preconditions / Affected

Every PHP installation that serves web requests is affected: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP. Any install without the update is vulnerable.

• mod_php carries the highest demonstrated risk, because an attack can succeed before any application code runs. PHP names this configuration as the priority for internet-facing servers.
• Session Upload Progress is on by default and is one confirmed path to CVE-2026-109619. The page says it is not the only path.
• PHP 7.4, 8.0 and 8.1 no longer get official updates.

What to do

Update to the fixed release for your branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For 7.4, 8.0 and 8.1, use a distribution or LTS vendor package, PHP's minimal source backports, or move to a supported branch.

1. Check the version that actually serves web requests, using phpinfo() output or your package manager. The command-line php binary can differ from the one PHP-FPM or Apache runs.
2. Preserve PHP and web server logs, configuration snapshots and suspicious files before changing anything.
3. Install the update, then restart every PHP worker so the fix takes effect.
4. Where you cannot update immediately, restrict internet access to those systems. The UK NCSC (21 October 2026) also urged considering taking such systems offline.

Compromise checks: look for new web shells, unexpected cron jobs and newly created accounts tied to PHP processes. In logs, look for unusually large or deeply nested multipart requests, PHP workers that crashed or hit their memory limit, and unexplained files in web roots or outbound connections from PHP processes. The NCSC advises checking for backdoors before upgrading any system that was not patched promptly.

Caveats

• Changes to .ini files are ineffective, and PHP states no configuration change fully closes the vulnerabilities.
• The page's "fix available: for some affected versions" refers to the end-of-life branches, which have no official fix.
• Because exploitation began on the day of release, systems that went unpatched for several days warrant the compromise checks, not only the update.
• The detection hints are general indicators, not signatures. The page gives no exploit request format or log query.
• Much of the page describes watchTowr's commercial platform.