PHP2Shell: critical PHP vulnerabilities and what to do

Mi a PHP2Shell?

PHP2Shell is the collective name for two related memory safety flaws in PHP core, identified as CVE-2026-109618 and CVE-2026-109619. The PHP project released security updates for them on 21 October 2026.

The flaws are in the runtime: the same vulnerable PHP may serve WordPress, Laravel, or a custom PHP application. An up-to-date CMS does not make an old PHP runtime safe. Assess installations that handle public web requests first.

What happens inside PHP?

For CVE-2026-109618, handling an out-of-memory condition may interrupt a request while internal data are only partly initialized. Later cleanup can treat those data as valid. For CVE-2026-109619, request-specific global state may persist after memory is freed; a later request in the same worker may use that stale state.

The official PHP advisory warns that both flaws could allow unauthenticated remote code execution. It rates the risk especially high for Apache mod_php: a demonstrated path can trigger the flaw before application code runs. Other web SAPIs, including PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, are also affected. Technical details depend on the environment; do not judge exposure by whether a single public proof of concept works.

What kind of consequences could it have?

If code execution succeeds, an attacker may access files, configuration, and systems reachable by the application with the PHP worker’s privileges. That could lead to modified websites, exposed data and secrets, installed malware, or an outage. The exact impact depends on worker permissions and environment isolation.

Memory safety flaws also raise the risk that sensitive process data could leak. We are not claiming that every affected server was attacked: exposure and confirmed compromise are separate matters. If you find suspicious signs, treat them as an incident and preserve the logs.

Affected and patched PHP versions

The first patched PHP project releases are listed below. Distribution or provider packages may backport the fix to an older version number; in that case, check the package security advisory and build identifier. PHP 8.1 and older branches are no longer under the PHP project’s normal support.

How can you mitigate the risk and verify the fix?

Inventory every web-facing PHP environment: domains, subdomains, PHP-FPM pools, Apache modules, containers, separate PHP runtimes invoked by cron, and runtimes used by control panels. Command-line `php -v` shows only the CLI binary; verify the version serving web requests separately.

Install a patched release from the PHP project or your distribution. Update container images, replace running instances, and restart all affected workers. With Plesk, also check the version of Plesk’s own PHP engine, alongside the site PHP handlers. After upgrading, test the websites and record the actual version serving web requests.

• If you use a backported package, check the provider advisory for fixes to both CVEs.
• Check logs for errors, worker crashes, and unusual outbound connections. Missing logs do not prove that no attack occurred.
• If you see suspicious activity, isolate the affected instance, preserve evidence, and rotate credentials and secrets based on the investigation.
• The related knowledge-base article provides a concrete step-by-step checklist.

What if you cannot upgrade now?

According to the PHP security team, there is no complete configuration workaround: upgrading is the only full fix. The official advisory describes several partial mitigations, such as disabling session upload progress and limiting request sizes. Use these only as documented short-term steps, because another attack path or variant may remain.

`memory_limit=-1`, for example, may remove one trigger involving a controllable PHP memory limit, but it can cause resource exhaustion and does not fix the underlying flaws. Neither a WAF nor a CMS update replaces patched PHP. If no verifiable patch is available, consider temporarily restricting or shutting down the affected web-facing PHP service.

Frequently asked questions

I use WordPress. Is updating WordPress enough? No. You must also patch the PHP runtime; updating WordPress remains a separate, important maintenance task.

Is the output of `php -v` enough? Not necessarily. The CLI and web server may use different binaries, pools, or containers.

Can a sitemap or SEO tool show whether you are affected? No. This is an operational question that requires checking the PHP runtime actually serving requests and the vendor patch.