PHP's Critical PHP2Shell Vulnerabilities (CVE-2026-109618 / 109619): A Technical Summary for Engineers [Updated Regularly]

On October 21, 2026 (11:00 PM JST, 2:00 PM UTC), the PHP security team released fixes for two critical vulnerabilities that can lead to unauthenticated remote code execution (RCE) (PHP news). The pair is nicknamed “php2shell.” In Japan, a large number of organizations took services offline as a precaution while the release was only pre-announced (piyolog’s compilation).

This article is for engineers who run PHP. It is built around the official advisories (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp) and separates what is confirmed from what is third-party claim or still unverified. Sources are given next to each statement. The situation is moving, so it is updated daily for the next two days. Times are in JST (UTC+9) unless noted.

Update log

• Initial version (published October 21; information current as of the morning of October 22 JST): written from the official advisories, the PHP announcement, and vendor statements

Key points

• Affected: PHP 8.2 to 8.5 before the fixed releases. The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (GHSA-w8hw-w9fx-j79w).
• Severity: PHP rates both CVSS v4.0 9.2 (Critical). No authentication is needed, and code runs with the privileges of the web worker (GHSA-6wmf-4rv5-p3rp).
• Highest risk: Apache with mod_php. The advisory says RCE has been demonstrated there (GHSA-w8hw-w9fx-j79w).
• PHP-FPM: for CVE-2026-109619, the session upload-progress path has been verified. A complete FPM exploit for CVE-2026-109618 had not been demonstrated at the time of the advisory (GHSA-6wmf-4rv5-p3rp, GHSA-w8hw-w9fx-j79w).
• Configuration-based mitigations are all incomplete. PHP says updating is the only complete fix (PHP’s announcement).
• There are reports of exploitation attempts. As of the morning of October 22, we could not find any public report of successful compromises or of their scale (see the sources under “Exploitation status and how much to trust it” below).
• For 7.4, 8.0 and 8.1, the PHP team provides minimal source backports. For anything older, there is no fix from the PHP project (PHP’s announcement).

The two vulnerabilities

Reading the vector: network attack, no privileges, no user interaction, but high attack complexity and a requirement that certain conditions be present. PHP says exploit portability and reliability depend on the PHP build, extensions, front-end behavior, and allocator layout. That is not “trivially exploitable,” but it has been shown to work against mod_php once the conditions line up (GHSA-w8hw-w9fx-j79w).

CVE-2026-109618: memory corruption during out-of-memory handling

When PHP runs out of memory, it leaves the current execution context with longjmp() and aborts the request. In some contexts, however, this escape can happen before request memory is fully initialized. The request memory is then left in an inconsistent state, and the shutdown code reads it or branches on it (GHSA-w8hw-w9fx-j79w).

For triggering memory exhaustion, the advisory points to multipart parsing. A multipart request without a usable Content-Length can pass the initial post_max_size check. There is also no limit on how many headers one part can carry, and each header costs memory to represent inside PHP, so a request within post_max_size can still exhaust a normal memory_limit (GHSA-w8hw-w9fx-j79w).

By SAPI, according to GHSA-w8hw-w9fx-j79w:

The verified RCE targets mod_php in a normal prefork setup with multiple workers, using PHP’s default input and memory limits.

CVE-2026-109619: stale global state (use after free)

Per-worker global state (errors, sessions, objects, extension state) can fail to be reset at the end of a request and keep pointing at memory that has since been freed. If the next request handled by the same worker uses that stale state before normal initialization, it dereferences freed memory. The advisory lists the impact as unauthenticated heap use-after-free, memory disclosure, and RCE with the web worker’s privileges (GHSA-6wmf-4rv5-p3rp).

The paths GHSA-6wmf-4rv5-p3rp confirms:

• The fatal_error_backtraces path on PHP 8.5 when that setting is enabled (RCE confirmed on mod_php)
• The session upload-progress (session.upload_progress) path. The feature is on by default and does not require session_start() (verified on both mod_php and FPM)
• A path where warnings about invalid or deprecated settings applied before initialization (for example auto_detect_line_endings=1, the legacy assert.* settings in PHP 8.3 and later, or an invalid memory_limit) are emitted as diagnostics. Changing error_reporting or using @ does not prevent it

The trigger demonstrated so far is OOM during input processing.

How it was fixed

According to GHSA-w8hw-w9fx-j79w, the fix removes longjmp() on OOM. Instead it uses a deferred, softer OOM that fires at the next safe point in the VM. If memory use reaches a second, higher threshold, it terminates immediately with _exit(). PHP’s normal memory-limit behavior is preserved.

Are you affected?

Versions

The official advisories (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp) list these as affected:

There are also claims that the bug reaches back to 5.4.0. That comes from the reporting side (Calif), as relayed by Tenable, and has not been confirmed in the official advisory.

To check:

php -v                         # CLI version (may differ from the version serving the web)
php-fpm -v                     # PHP-FPM
apachectl -M | grep -i php     # is mod_php loaded?

The CLI version and the PHP that serves web requests can be different things. Check the one that handles web traffic, including FPM pools and containers. With Docker, run docker run --rm <image> php -v against the image you actually use.

Distribution packages sometimes pick up the fix without changing the version number. In that case, check the changelog. Adjust package names to your environment.

# Debian / Ubuntu
apt changelog php8.4-cli | grep -i -m1 CVE-2026-109618

# RHEL / Rocky / Alma
rpm -q --changelog php | grep -i -m1 CVE-2026-109618

What about WordPress, Laravel, and the like?

The vulnerable component is the PHP runtime itself. Updating WordPress or Laravel does nothing if PHP is not on a fixed version. Conversely, once PHP is updated, application-level fixes are not required for this issue.

There are reports (from Wiz and Calif, as relayed by Huntress and Tenable) of unauthenticated RCE demonstrated against WordPress, Drupal, and Joomla. Those are third-party reports that the official advisory does not confirm.

What to do

1. Update PHP (the only complete fix)

Where the main distributions stand as of the morning of October 22. Debian is from the Debian Security Tracker; the rest is from piyolog’s compilation. This is moving fast, so always check your own distribution’s advisory:

For Docker, the docker-library definitions (versions.json) are updated to the four fixed releases (8.5.12, 8.4.27, 8.3.36, 8.2.35). We have not verified that the images themselves have been published, so pull again and confirm with php -v. According to PHP’s announcement, Windows builds are listed on the official downloads page.

After updating, restart all PHP workers (FPM pools, Apache workers). Reloading configuration alone can leave old workers running.

2. If you cannot update right away: interim settings

These are the interim mitigations from PHP’s announcement and the two advisories (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp). None of them makes you safe. Use them to buy time until you can update.

For CVE-2026-109618, set memory_limit to -1 in a way the application cannot override.

# Apache (mod_php)
php_admin_value memory_limit -1

; PHP-FPM pool configuration
php_admin_value[memory_limit] = -1

For CVE-2026-109619, disable session upload progress. Put it somewhere that is applied before request parsing: php.ini, the FPM pool, or the server configuration. ini_set() and .user.ini cannot be relied on. On PHP 8.5, also disable fatal_error_backtraces.

; php.ini
session.upload_progress.enabled = 0
fatal_error_backtraces = 0    ; PHP 8.5 only

; or in the PHP-FPM pool configuration
php_admin_flag[session.upload_progress.enabled] = off

After changing these, restart all workers. Also check that no finite memory limit has been put back at the pool, directory, or application level.

Three cautions:

• memory_limit = -1 is not a complete mitigation. If an underlying allocation (such as mmap()) fails, the same path can still be reached. It also raises the risk that a single request eats all the server’s memory, so always combine it with the front-end limits below
• Do not use RLIMIT_AS or RLIMIT_DATA limits (ulimit -v, systemd LimitAS= or LimitDATA=, and so on). PHP’s announcement says that when the limit is hit, mmap() fails and triggers the vulnerable path
• Container or cgroup memory limits are useful as an availability boundary that kills only the affected worker, but they are not a complete mitigation

3. Limit requests at the front end

PHP’s announcement lists these as measures that reduce risk but do not replace the fix:

• Set post_max_size conservatively (around 8M if you don’t need file uploads, around 32M if you do; keep upload_max_filesize below it)
• Independently limit the decoded request size at the web server or proxy, including for requests without Content-Length
• Lower max_input_nesting_level, and limit the number of input variables, multipart parts, headers per part, and uploads
• If an application does not use multipart forms, block those requests at the front end

Cloudflare’s CTO announced WAF rules for known attack paths for all customers, including free plans. Cloudflare itself describes them as a stopgap, and they only apply to traffic that goes through Cloudflare (Tenable, piyolog’s compilation).

4. 7.4, 8.0, 8.1, and anything older

According to PHP’s announcement, for people building from source or without an LTS vendor, the PHP security team provides minimal backports for 7.4, 8.0 and 8.1 on these branches:

• PHP-7.4-CVE-2026-109618-109619
• PHP-8.0-CVE-2026-109618-109619
• PHP-8.1-CVE-2026-109618-109619

There is no fix from the PHP project for 7.3 and earlier. You need a vendor LTS (such as Ubuntu Pro) or a move to a supported version. Also note that PHP 8.2 reaches end of life on December 31, 2026, according to PHP’s announcement. This is a good moment to revisit your migration plan.

5. Checking whether you were already compromised

Updating does not remove a compromise that happened between disclosure and your patch. Huntress recommends watching for signs such as:

• PHP workers (php-fpm, php-cgi, httpd, apache2) spawning shells (sh, bash, cmd.exe, powershell.exe), interpreters (python, perl), or download tools (curl, wget, nc, certutil.exe)
• Command lines with classic reverse-shell patterns such as /dev/tcp/, fsockopen, or mkfifo
• Reconnaissance commands run from the web server, such as whoami, id, uname -a, or ipconfig
• Unfamiliar files under the web root (web shells), and new cron jobs, scheduled tasks, or accounts

Huntress lists indicators of compromise (IOCs) as “to be determined” for now. The PHP advisory recommends auditing with log_errors, error_log and error_reporting=E_ALL, while warning that an absence of log entries is not proof of safety.

This one is my own observation: a sudden rise in PHP-FPM log lines saying a worker “exited on signal 11 (SIGSEGV)” may indicate attempts. It is not an official IOC, but it is a useful lead.

If you suspect compromise, preserve logs and isolate the server. Every credential visible to the PHP worker (database passwords, API keys, tokens) will need to be rotated.

What not to do

• Do not run “exploits” you found online on your own servers. According to Tenable, the PHP Foundation inspected the code that circulated after disclosure and did not identify any functional exploits, and Tenable itself warns the code may contain malware
• Do not rely on a WAF alone. It only reduces known attack paths
• Do not treat the lack of errors in your logs as evidence of safety

Exploitation status and how much to trust it

Reports on exploitation conflict. Here they are with a confidence level.

Be careful with old information. Articles written right after the leak sometimes still say “no fix is available yet” or “5.x through 8.x are affected,” which no longer matches the official information.

Timeline

Times are in JST. The source is piyolog’s compilation. The release of the fixed versions can also be confirmed in PHP news.

What’s happening in Japan

After the pre-announcement, many organizations in Japan took services offline on the night of October 21 as a precaution. piyolog’s compilation (as of the morning of October 22) counts 211 organizations: government bodies, municipalities, financial institutions, games, e-commerce, video and streaming, shared-hosting providers, and more. Nikkei xTECH also reported the partial shutdown of Sakura Internet’s services and emergency maintenance at Cygames and pixiv.

According to piyolog’s compilation, shared-hosting providers that run PHP responded as follows (as of the morning of October 22; always check each provider’s notice):

• Sakura Internet: updated server-side PHP (done at 6:30 AM). Customers on old PHP versions were advised to switch to PHP 8.3
• Xserver: applied the fix to PHP 8.2 to 8.5 on affected servers (as of 6:45 AM). Its corporate site and control panel were taken down as a precaution and are being restored one by one after checks
• KAGOYA Japan: PHP 8.2 to 8.5 to be updated in turn once fixed versions are available
• IDC Frontier (Zenlogic): PHP update and patch applied (with maintenance that stops Apache)
• Lolipop! and heteml: service sites and control panels stopped as a precaution

On shared hosting, updating PHP is the provider’s job. But if you have selected an old PHP version, you may be outside the scope of the update. Check which PHP version your control panel uses.

Among public bodies in Japan, IPA and the National Cybersecurity Office urged preparation for the release on October 21 (piyolog’s compilation).

What we’re tracking

The daily updates will follow these points:

• Real-world exploitation: reports of successful compromise, and whether the CVEs are added to CISA’s KEV catalog
• How effective the public PoCs actually are
• Updates from the Remi repository, php8.5 on Amazon Linux 2023, RHEL, and others
• How the backports for 7.4, 8.0 and 8.1 are being used
• Any further fixes or corrections to the official information

If you need help taking stock of your PHP environments, updating them, or checking for compromise, get in touch below.