PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619

The PHP project has disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Both vulnerabilities carry a CVSS 4.0 score of 9.2 (Critical). An unauthenticated remote attacker can exploit these flaws to achieve remote code execution, no user interaction or prior access is required. The PHP security team considers the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. PHP released fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, and has stated there are no complete mitigations; updating is the only safe choice. Exploitation has been confirmed in the wild since at least October 21, 2026.

What do I need to know? 

What do I need to do? 

We recommend the following steps to identify and remediate this vulnerability: 

• Review and Audit 
  • Identify all PHP installations in your environment: including web servers, application servers, containers, and third-party products that bundle PHP, and confirm the installed version and server API in use (PHP-FPM, mod_php, php-cgi, FrankenPHP, or LiteSpeed). 
  • Prioritize internet-facing PHP installations, particularly those running Apache with mod_php. 
  • Identify any systems running PHP 8.1 or older, which no longer receive updates from the PHP project, and confirm backported fix availability with your distribution or LTS vendor. 
  • PHP has not published specific IOCs. Treat any anomalous activity on PHP web servers: such as unexpected worker crashes, out-of-memory errors, unexplained fatal errors, or unexpected child processes spawned by PHP or web server processes, as a potential indicator of exploitation. 
  • If an unpatched PHP installation is reachable from the internet, treat it as potentially compromised pending update and investigation. 

• Patch Immediately 
  • Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, released by the PHP project on October 21, 2026 under the PHP security advisory. Source downloads and Windows binaries are available on the PHP downloads page. 
  • Linux distributions and LTS vendors received the patches in advance. Check your vendor for updated packages. 
  • If you rely on the volunteer-maintained rpms.remirepo.net repository, switch to distribution packages or build from source. The PHP project has advised that this repository will not have updates on the day of release. 
  • For PHP 7.4, 8.0, and 8.1, the PHP security team has provided minimal source backports (PHP 7.4, PHP 8.0, PHP 8.1) for those building from source or without access to an LTS vendor. Otherwise, upgrade to a supported version. 
  • Restart all PHP workers and web server processes after updating to ensure the patched version is loaded. 
  • There are no complete mitigations. The only complete remediation is the update. Note that PHP 8.2 reaches end of life on December 31, 2026; plan upgrades to a supported version. 

Mitigation (If Patching Is Delayed) 

• CVE-2026-109618 (RCE via OOM corruption): 
  • Set memory_limit=-1 in a way applications cannot override (e.g., php_admin_value in the FPM pool or Apache configuration), and confirm no pool, directory, or application setting reapplies a finite limit. 
  • Set a low post_max_size: 8M for applications that do not require file uploads, or 32M if uploads are necessary. Keep upload_max_filesize below post_max_size. 
  • Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth, including for requests without a usable Content-Length. 
  • Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can trigger the vulnerable allocation failure. 
• CVE-2026-109619 (RCE via stale global state): 
  • Set session.upload_progress.enabled=0 in php.ini, the FPM pool, or server configuration and restart every worker. Do not rely on ini_set() or FPM .user.ini. 
  • On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. 
  • Remove invalid or deprecated per-request settings that emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors, or @ does not help. 
  • Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing, and cleanup. 
• Monitor PHP and web server logs for repeated out-of-memory errors, fatal errors, or worker crashes, and alert on unexpected processes spawned by PHP or web server accounts. 
• If an unpatched internet-facing PHP installation shows signs of exploitation, treat the system as compromised: initiate incident response, isolate the host if feasible, and preserve logs before applying the update. 

NetSPI Product and Services Coverage  

NetSPI EASM: NetSPI’s External Attack Surface Management team is working to release a version-based detection for these vulnerabilities as soon as possible. Because the exact PHP version is often not exposed externally, and the majority of PHP versions released in recent years are affected, we recommend that customers visit the Applications Page and search for PHP to review all assets listed as presenting PHP services. 

NetSPI Penetration Testing: NetSPI’s Penetration Testing Services can assist with verifying exposure and validating your patching efforts: NetSPI PTaaS. 

NETSPI INTERNAL RESPONSE 

NetSPI  systems are not affected by CVE-2026-109618 or CVE-2026-109619. Continuous review, monitoring, and patch validation remain in place. 

ADDITIONAL RESOURCES 

• NVD — CVE-2026-109618 
• NVD — CVE-2026-109619 
• MITRE — CVE-2026-109618 
• MITRE — CVE-2026-109619 
• PHP Security Advisory — Critical remote code execution vulnerabilities 
• GitHub Security Advisory — GHSA-w8hw-w9fx-j79w (CVE-2026-109618) 
• GitHub Security Advisory — GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) 
• PHP Downloads