A severe global cybersecurity event is unfolding across the web development and server hosting landscapes. The PHP Development Team issued emergency core security updates to address two CVSS 9.2 (Critical) Remote Code Execution (RCE) vulnerabilities.
Dubbed PHP2Shell, these flaws affect almost all active and legacy installations of PHP, exposing millions of websites running platforms like WordPress, Laravel, Drupal, and custom PHP backends to potential unauthenticated attacks.
If you manage web servers, client sites, or enterprise IT environments, immediate action is required.
What Are the PHP2Shell Vulnerabilities?
Tracked officially as CVE-2026-109618 and CVE-2026-109619, these flaws exist within the core PHP interpreter runtime rather than any specific web application framework or plugin.
1. CVE-2026-109618: Out-Of-Memory (OOM) Memory Corruption
- CVSS Score: 9.2 (Critical)
- Mechanism: When a request exceeds memory limits, PHP triggers internal cleanup routines. Interrupted execution can force PHP to process partially initialized memory structures, leading to memory corruption and remote code execution.
2. CVE-2026-109619: Stale Global State (Use-After-Free)
- CVSS Score: 9.2 (Critical)
- Mechanism: Internal state data surviving freed memory allocations can persist across worker cycles, allowing subsequent requests handled by the same worker process to trigger arbitrary execution paths.
Why This Is Dangerous: Attackers do not need valid user credentials or access to your application logic. Malicious requests execute at the server layer before application-level security filters or login checks run.
Patched Versions & Recommendations
The PHP core team released emergency security patches across all active release branches. System administrators must update PHP runtimes to one of the following minimum versions immediately:
| PHP Branch | Fixed Version | Status |
| PHP 8.5 | 8.5.12 | Patched |
| PHP 8.4 | 8.4.27 | Patched |
| PHP 8.3 | 8.3.36 | Patched |
| PHP 8.2 | 8.2.35 | Patched |
| PHP 8.1 & older | End-of-Life (EOL) | Unsupported — Upgrade Immediately |
Step-by-Step Mitigation Checklist for System Admins
- Verify Your Server Runtime: Check active PHP versions using php -v or via your web hosting dashboard (cPanel, Plesk, Forge, etc.).
- Apply Security Updates: Update your packages immediately via your distribution package manager (apt upgrade php, yum update php) or rebuild your application deployment containers.
- Restart PHP Processing Pools: Restart your php-fpm, Apache (mod_php), or web worker services so changes take effect.
- Audit Legacy Systems: If running EOL PHP versions (such as PHP 7.x or 8.1), upgrade to a supported release branch immediately or apply vendor-provided backported patches if using enterprise Linux distributions.
Need Assistance?
If you need help auditing your web infrastructure or securing your servers against emerging threats, feel free to reach out directly through Mumarasghar.com.
