PHP2Shell: Critical Unauthenticated RCE in PHP Core
In October 2026, the PHP project disclosed two critical vulnerabilities in the PHP runtime itself, collectively referred to as PHP2Shell. Tracked as CVE-2026-109618 and CVE-2026-109619, both carry a CVSS v4.0 score of 9.2 and can allow unauthenticated remote code execution on servers that handle web requests with an affected PHP version.
What is affected
The issues are in PHP’s core memory and request-handling code, not in any particular application. Any installation serving web requests (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed, and similar) is potentially affected. Supported branches were fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older branches (8.1 and earlier) do not receive official upstream fixes, though some distributions and vendors have published backports.
Why it matters
Because the flaws exist in the PHP engine, application-level authentication and input validation do not prevent exploitation. An attacker needs only the ability to send HTTP requests to a vulnerable PHP process. CISA added both CVEs to its Known Exploited Vulnerabilities catalog. Exploitation attempts were observed shortly after disclosure. PHP powers a large share of websites, so the potential exposure is broad.
Recommendations
- Upgrade to a fixed PHP release (8.5.12, 8.4.27, 8.3.36, or 8.2.35, or a vendor-patched equivalent) and restart PHP workers.
- Prioritize internet-facing systems, especially those using Apache with mod_php.
- For unsupported PHP versions, migrate to a supported branch or confirm a reliable backport from your distribution or hosting provider.
- Review logs for unusual request patterns around the disclosure window if systems were exposed and unpatched.
This post is for awareness only and does not include exploit details. Always consult the official PHP security advisories and the CISA KEV catalog for the latest status.