Back
PHP2Shell: Two critical RCE flaws in PHP and what to do now
On 21 October 2026, PHP shipped an emergency security release for two critical flaws. Dubbed "PHP2Shell" by researchers, they allow code execution on PHP servers that handle web requests, without any login. Exploitation attempts were seen on the day the patch came out.
What happened?
Details of the flaws leaked on social media on 20 October, ahead of the planned disclosure. PHP published an advance notice the same day and released the fixes on 21 October at 14:00 UTC. watchTowr reported exploit traffic against its honeypots that same day, and Cloudflare also reported attack traffic.
| CVE | Type | CVSS v4.0 |
|---|---|---|
| CVE-2026-109618 | RCE via partially processed request data during memory exhaustion (OOM) | 9.2 |
| CVE-2026-109619 | RCE and memory disclosure via stale global state left over from a previous request | 9.2 |
Neither flaw requires authentication or user interaction. Researchers showed that the second flaw can be used to read PHP worker memory, which can expose passwords, session keys and API keys.
Who is affected?
Every PHP installation that handles web requests: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP. PHP rates Apache mod_php as the highest risk, because the attack can succeed before any application code runs.
| PHP version | Fixed version |
|---|---|
| 8.5.x | 8.5.12 |
| 8.4.x | 8.4.27 |
| 8.3.x | 8.3.36 |
| 8.2.x | 8.2.35 |
| 7.4, 8.0, 8.1 | No official release; use your distribution's package, PHP's limited source patch, or upgrade |
| 7.3 and earlier | No fix; upgrade to a supported version |
Linux distributions may have backported the fixes into packages that keep the old version number, so check your distribution's security advisory. Also note that php -v on the command line may report a different version from the one serving web requests.
What should you do?
- Build an inventory. Start with internet-facing servers and anything running mod_php. Don't forget container images, hosting control panels (cPanel, Plesk) and appliances or software that ship with an embedded PHP.
- Apply the patch and restart every PHP worker. According to PHP, no configuration change fully closes these flaws.
- Systems you cannot patch right away should be taken off the internet or put behind a VPN or WAF.
- As an interim measure, apply the settings PHP recommends:
session.upload_progress.enabled=0(in php.ini or at FPM pool level), lowerpost_max_sizeand request size limits, and block multipart requests where you don't use them. - Look for signs of exploitation. php-fpm, httpd or apache2 processes spawning shells, script interpreters or download tools; new files in the web root; new cron jobs and accounts.
- If you suspect compromise, isolate the server, preserve web and PHP logs, and rotate the passwords and API keys stored on it.
How Nokta Guard can help
In our external network and web application penetration tests we identify your internet-facing PHP systems and verify their patch status. Where exploitation is suspected, a forensic examination of the server shows what the attacker did.
Related services: Web Application Penetration Testing, Vulnerability Management, Server and Enterprise System Forensics
Sources: watchTowr FAQ · Qualys · The Hacker News