The PHP security team has released emergency security updates to address two critical Remote Code Execution (RCE) vulnerabilities, tracked under the name PHP2Shell. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, allow unauthorized attackers to take control of affected servers.
Vulnerability Details and Impact
These vulnerabilities were discovered through the joint efforts of researchers at Calif, OpenAI, and Wiz. The severity of these flaws lies in the fact that they affect all PHP runtime environments that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The PHP security team explained that the greatest risk lies in mod_php configurations, where an unauthorized attacker can execute an attack before any application-specific code starts running. Both vulnerabilities stem from a fundamental issue involving memory being left in a corrupted state when a request terminates abnormally, which opens the door for exploitation to execute remote code.
Required Actions for Administrators
System administrators must update their servers immediately to the following secure versions: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. For older versions (7.4, 8.0, 8.1) that no longer receive official updates, the PHP team has provided backports to help secure systems that still rely on these versions.
Why This News Matters
PHP is considered the backbone of approximately 75% to 80% of websites globally, including popular platforms such as WordPress and Drupal. Given that there are more than 5 million PHP servers exposed to the internet, the exploitation of these vulnerabilities poses a widespread threat. Cloudflare has confirmed that it has already observed early exploitation attempts of these vulnerabilities, prompting the UK's National Cyber Security Centre (NCSC) to issue an urgent warning to organizations to update immediately or disconnect systems from the network.
Temporary Mitigation Measures
In the event that an immediate update is not possible, the PHP security team has provided some mitigation measures to reduce the chances of exploitation, including:
- For CVE-2026-109618: Set memory_limit to -1, and reduce post_max_size to 8 MB (or 32 MB if file uploads are required).
- For CVE-2026-109619: Set session.upload_progress.enabled to 0, and in version 8.5, set fatal_error_backtraces to 0 and restart the workers.
Developers emphasize that these measures do not provide complete protection and that the official update is the only way to ensure server security permanently.