As reported by The Hacker News, PHP has issued emergency patches for two critical remote code execution vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both flaws carry a CVSS v4.0 score of 9.2 — Critical and reside in the PHP runtime engine itself, meaning every application built on PHP is exposed regardless of how well its own code is secured.
Vulnerability Details
| Attribute | Details |
|---|---|
| CVE Identifiers | CVE-2026-109618, CVE-2026-109619 |
| CVSS v4.0 | 9.2 (Critical) |
| Affected Software | PHP runtime — all versions from PHP 5.4 through current branches |
| Fixed Versions | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| Patch Available | Yes — update PHP runtime and restart web server / PHP-FPM workers |
| Active Exploitation | Yes — exploit attempts have emerged in the wild |
| Highest Risk Configuration | Apache mod_php (RCE triggers before application code executes) |
| Discoverers | Researchers at Wiz, Calif, and OpenAI |
Why This Matters
What makes PHP2Shell particularly dangerous is its location in the PHP engine rather than in any application layer. This fundamentally inverts the standard web vulnerability remediation model, where patching the application or framework typically resolves the issue. Here, even a trivially simple PHP page — a static "Hello World" script — is fully exploitable if the underlying runtime is unpatched. This means the universe of affected targets extends far beyond complex applications like WordPress or Laravel to include every server that processes any PHP request at all.
The distinction between mod_php and PHP-FPM is operationally significant. With mod_php, the exploit fires before application code executes, making it essentially unavoidable without a runtime update. PHP-FPM's process isolation model degrades gracefully on some failure paths, reducing exploitability for one of the two CVEs — but the second CVE was demonstrated to achieve code execution against FPM as well, albeit under conditions dependent on the running application.
Beyond RCE, the memory disclosure capability is a quieter but equally serious concern. Attackers can read live worker process memory, potentially extracting passwords, API tokens, session data, and cryptographic certificates from concurrent or prior requests. This enables lateral movement and credential theft without ever achieving code execution — a scenario that could persist undetected far longer than an obvious RCE payload.
Who Is at Risk
Shield53 Recommendations — Immediate Actions
- Patch the PHP runtime now. Update to the latest fixed version for your branch (8.5.12, 8.4.27, 8.3.36, or 8.2.35). Do not assume your CMS or framework update covers this — it does not.
- Restart all PHP-serving processes. After patching, restart Apache, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed, and any long-running PHP workers. A patched binary that is not restarted remains vulnerable.
- If running mod_php, consider migrating to PHP-FPM as a defense-in-depth measure. The process isolation model provides materially better blast-radius containment for this class of vulnerability.
- Audit for PHP 8.1 or older. These branches will never receive a fix. Plan immediate upgrade or migration for any production system still running them. PHP 8.2 reaches end-of-life in December 2026 — begin planning now.
- Rebuild container images. If you deploy PHP in containers, rebuild from updated base images and redeploy. Running containers will not self-patch.
- Rotate credentials. Given the memory disclosure capability, rotate API keys, database passwords, and application secrets on any server that was running a vulnerable PHP version, particularly in shared-tenant environments.
- Deploy WAF rules. While waiting for patches to propagate across large estates, apply virtual patches or WAF rules to block anomalous request patterns targeting PHP initialization. Check with your WAF vendor for PHP2Shell-specific signatures.
- Hunt for indicators. Review web server and PHP-FPM logs for anomalous early-request failures, unexpected process restarts, or out-of-band memory access patterns that may indicate attempted or successful exploitation.
This is a rare event — a fundamental runtime vulnerability affecting nearly the entire PHP ecosystem with active exploitation in the wild. The window between disclosure and widespread exploitation is already closing. Prioritize patching over all other security operations today.
