Two Critical PHP Vulnerabilities Discovered: Is Your Website at Risk? | PHP2Shell Explained
Nearly 70% of websites with a known server-side programming language rely on PHP, an open-source technology that powers everything from business websites to complex web applications.
But what happens when critical vulnerabilities in this widely used technology put websites at risk?
For businesses that depend on their websites for daily operations, a security flaw allowing attackers to execute malicious code could compromise sensitive data, disrupt services, and threaten business continuity.
This is the concern surrounding PHP2Shell, two critical PHP vulnerabilities disclosed on 21 October 2026 that could allow unauthenticated attackers to execute code remotely on vulnerable installations.
What Is PHP2Shell? Two Critical PHP Vulnerabilities Explained
On 21 October 2026, PHP released emergency security updates addressing two critical vulnerabilities, collectively known as PHP2Shell.
Tracked as CVE-2026-109618 and CVE-2026-109619, both vulnerabilities carry a CVSS v4.0 score of 9.2 (Critical).
These flaws involve how PHP handles memory and internal request data. Under vulnerable deployment conditions, attackers may exploit them through specially crafted requests without requiring valid login credentials.
The emergency release followed the premature disclosure of technical vulnerability details, raising concerns about potential exploitation before patches became available.
CVE-2026-109618: Remote Code Execution via Out-of-Memory Corruption
This vulnerability occurs when an out-of-memory (OOM) error interrupts PHP while it is processing a request.
Under certain conditions, PHP may leave internal request data partially initialized. During cleanup, it can mistakenly treat this incomplete data as valid, potentially causing memory corruption.
The risk: Attackers may exploit this condition through specially crafted requests to achieve remote code execution (RCE) on vulnerable installations.
CVE-2026-109619: Remote Code Execution via Stale Global State
This vulnerability involves PHP retaining references to memory that has already been freed.
When a PHP worker processes a subsequent request, it may access these outdated references before its internal state is properly reset, creating a use-after-free condition.
The risk: Attackers may manipulate this condition to corrupt memory and execute malicious code remotely.
Although the vulnerabilities have different root causes, both can compromise the security of affected PHP installations.
How Can PHP2Shell Vulnerabilities Impact Your Website and Business?
Depending on the server configuration, application privileges, and connected systems, potential consequences include:
- Unauthorized System Access: Attackers could execute commands and access resources available to the compromised PHP process.
- Sensitive Data Exposure: Application data, database credentials, authentication tokens, and other confidential information could be exposed.
- Website Compromise: Attackers could modify website content, inject malicious code, or interfere with application functionality.
- Service Disruption: Exploitation could crash PHP processes, interrupt website availability, and affect business operations.
- Further System Compromise: A compromised server could become an entry point for attacks on connected applications or internal systems if permissions and network access allow it.
These are potential consequences of successful exploitation, not confirmed outcomes for every PHP website.
The key concern: A vulnerable website can create security risks beyond the application itself, potentially affecting the data and systems connected to it.
Which PHP Servers and Deployment Types Are Affected by PHP2Shell?
Not every website running PHP is vulnerable to PHP2Shell. The risk depends on the PHP version, deployment configuration, and whether the latest security patches have been applied.
Popular applications and frameworks such as WordPress, Laravel, and Nextcloud may also be exposed when running on vulnerable PHP installations. The vulnerabilities affect the underlying PHP environment, not necessarily the applications themselves.
Your website may be at risk if:
- You’re running a vulnerable PHP version: PHP 8.2, 8.3, 8.4, or 8.5 installations without the relevant security fixes, as well as older unsupported versions without applicable backported patches.
- Your website is publicly accessible: Internet-facing PHP applications may be exposed to unauthenticated attacks.
- You’re using an affected PHP deployment: PHP-FPM, Apache mod_php, PHP-CGI, FrankenPHP, and LiteSpeed are among the affected deployment types.
Apache mod_php faces the highest reported risk, with researchers demonstrating an attack that can be triggered without authentication, before application code runs. Other deployments also require patching, although exploitability varies depending on their configuration.
How can you confirm if your website is vulnerable?
Check your PHP versions, deployment configurations, and security patch status. A vulnerability assessment can help identify affected installations and prioritize remediation, particularly for internet-facing systems.
How to Fix PHP2Shell: Affected PHP Versions and Security Updates
The most effective way to address PHP2Shell is to identify vulnerable installations and apply the latest security fixes.
Organizations should follow these steps.
1. Identify Vulnerable PHP Installations
Scan web servers, applications, cloud environments, containers, and other relevant infrastructure to locate affected PHP installations.
Prioritize internet-facing systems, especially Apache mod_php deployments.
2. Upgrade to Patched PHP Versions
Apply the official PHP security updates for supported PHP branches 8.2, 8.3, 8.4 and 8.5, confirming the appropriate fixed releases through the PHP development team’s official guidance.
| PHP Version | Vulnerable Versions | Fixed Version |
| PHP 8.5.x | 8.5.0-8.5.11 | 8.5.12 |
| PHP 8.4.x | 8.4.0-8.4.26 | 8.4.27 |
| PHP 8.3.x | 8.3.0-8.3.35 | 8.3.36 |
| PHP 8.2.x | 8.2.0-8.2.34 | 8.2.35 |
PHP 8.1 and older: These versions have reached End of Life (EOL) and no longer receive regular security updates from the PHP project. However, some operating-system distributions and long-term support (LTS) vendors may provide backported security fixes.
Organizations should check with their OS, hosting, or PHP package vendor for applicable security updates and plan migration to a supported PHP version.
Some Linux distributions provide backported patches that retain older PHP version numbers. Verify fixes against the relevant vendor security advisory rather than relying only on the displayed version.
3. Verify Patching and Check for Compromise
After applying the security updates:
- Restart affected PHP services and workers.
- Confirm that the running installations contain the required security fixes.
- Rescan affected systems to verify remediation.
- Review relevant server logs and security alerts for suspicious activity or possible exploitation attempts.
Quick Note: Are There Temporary Workarounds for PHP2Shell?
If immediate patching is not possible, organizations can temporarily reduce exposure through the following measures:
- CVE-2026-109619: Disable session upload progress by setting session.upload_progress.enabled=0 in the appropriate PHP configuration and restart all affected PHP workers.
- CVE-2026-109618:Set memory_limit=-1 at the server level and enforce strict HTTP request-size limits, with appropriate system-level memory safeguards.
Restricting public access and applying appropriate WAF protections may provide additional risk reduction.
Important: These are temporary mitigations, not complete fixes. Updating PHP remains essential.
PHP2Shell Indicators of Compromise (IOCs): What Should You Monitor?
Indicators of Compromise (IOCs) are signs of potentially malicious activity that help security teams identify and investigate possible attacks.
For PHP2Shell, organizations should monitor web server logs, WAF alerts, and network traffic for suspicious activity involving reported attacker IP addresses, unusual HTTP POST requests, and unexpected PHP process behavior.
Reported Suspicious IP Addresses:
31[.]223[.]184[.]166, 37[.]19[.]200[.]5, 103[.]114[.]163[.]188, 103[.]216[.]220[.]92, 134[.]209[.]159[.]64, 54[.]154[.]150[.]2, 52[.]250[.]54[.]233, 223[.]160[.]160[.]11, 34[.]136[.]122[.]211, 20[.]200[.]234[.]181, 3[.]68[.]250[.]21, 184[.]73[.]151[.]236, 147[.]182[.]222[.]30, 94[.]154[.]43[.]7, 104[.]28[.]233[.]170, 114[.]26[.]103[.]72, 5[.]189[.]184[.]114, 51[.]143[.]62[.]244, 45[.]198[.]224[.]169, 85[.]11[.]167[.]243, 20[.]24[.]237[.]207, 46[.]101[.]229[.]142, 136[.]69[.]138[.]198, 77[.]109[.]105[.]177.
Important: These IPs are supplied as reported indicators and have not all been independently verified as PHP2Shell-related. An IP match alone does not confirm compromise. Investigate it alongside suspicious requests and system activity.
Conclusion: Why Immediate PHP2Shell Patching Matters
PHP2Shell demands immediate attention. Identify vulnerable installations, apply the latest security patches, and verify remediation to reduce exposure.
How SQ1 Security Can Help
Whether you are evaluating your current WAF capabilities or need immediate work around assistance to protect your PHP web applications against PHP2Shell, our Security Operations team is ready to assist.