Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)

What it is

PHP2Shell is the name watchTowr uses for CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws in PHP, both rated CVSS v4.0 9.2. PHP shipped fixes in an emergency release on 21 October 2026. watchTowr says it has seen exploitation since that date.

How it works

CVE-2026-109618 occurs when PHP runs out of memory partway through request setup. That leaves half-built internal data that the cleanup code then trusts. CVE-2026-109619 involves internal state that outlives the request memory it points to. The next request handled by the same PHP worker can act on that leftover data. The page gives no exploit details beyond this.

Preconditions / Affected

• Any PHP installation that serves web requests is in scope: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP.
• PHP rates Apache mod_php as highest risk, because an attack can succeed before any application code runs.
• watchTowr confirmed that unsupported branches, including PHP 5, are affected. Discovery should cover every PHP install, not only supported versions.
• Exploitation was seen through watchTowr's Attacker Eye honeypot network. As of 22 October 2026, CISA had not added either CVE to its Known Exploited Vulnerabilities catalog. No attribution is public.

What to do

1. Inventory every server and application that runs PHP, starting with internet-facing systems. Put Apache mod_php hosts first.
2. Update to the fixed release for the branch in use: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions received the patches ahead of release, so check for updated distribution packages.
3. Restart every PHP worker after updating, so the fix takes effect.
4. For PHP 7.4, 8.0 and 8.1, use a distribution or LTS vendor package, use PHP's minimal source backports, or move to a supported branch.
5. Restrict internet access to any PHP system that cannot be updated immediately.

Caveats

PHP states that no configuration change fully mitigates these flaws, so the access restriction is a stopgap and not a fix. The page names no fixed version for PHP 5 or other unsupported branches. Disclosure was forced early: details leaked on social media on 20 October 2026, ahead of the planned 22 October date. Calif discovered the flaws. Much of the page describes watchTowr's own client services (Adversary Sight, Rapid Reaction, Active Defense), and it gives no detection queries or indicators of compromise.