PHP2Shell: two flaws in the PHP engine hand over the server, no authentication needed
Published
On 21 October 2026, the PHP project shipped four emergency releases. They fix PHP2Shell, two PHP core flaws scored 9.2 (CVSS v4): CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution with the web server account’s privileges. Details leaked the day before, two days ahead of the planned disclosure, and exploitation was seen on the very day of the fix.
Fixed: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (21 October 2026)
What does PHP2Shell actually allow?
CVE-2026-109618 fires when PHP runs out of memory halfway through setting up a request: internal structures are left half-built and become exploitable. CVE-2026-109619 comes from global state that outlives the request that created it: the next request handled by the same process acts on stale data.
What they share, and what makes them so serious: everything happens while PHP processes the request, before your script starts running. A file-upload (multipart) request is enough, on any page that accepts a POST, even a page that ignores uploaded files entirely.
Is my Magento or WordPress site affected?
Yes, as long as it runs on an unpatched PHP version. The flaw is not in Magento, not in WordPress, not in your plugin: it is in the engine that runs them. Laravel, Drupal, Symfony, PrestaShop, an in-house PHP API: same situation.
Every execution mode is affected (PHP-FPM, php-cgi, FrankenPHP, LiteSpeed). The PHP project rates Apache with mod_php as the most exposed setup: that is exactly where real code execution was confirmed on honeypots on 24 October 2026.
Is it already being exploited?
Yes. Amazon Threat Intelligence saw attempts from 17 October, four days before the fix. watchTowr has observed attacks on its honeypots since 21 October. Full code execution was documented on 24 October against an Apache mod_php install on PHP 8.4.26, and according to watchTowr, CISA added CVE-2026-109618 to its Known Exploited Vulnerabilities catalog on 26 October.
A third flaw, CVE-2026-115560, has no fix yet. It only affects rare combinations of configuration and application code; in the meantime, the PHP project recommends disabling `session.upload_progress.enabled`.
What should you do today?
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on your branch, then restart every PHP process: a running worker keeps the old code. The PHP project is explicit: no configuration change fully closes these flaws.
PHP 7.4, 8.0 and 8.1 only get minimal source backports or your distribution’s packages. PHP 7.3 and older, PHP 5 included, stay vulnerable with no fix: time to migrate.
Prioritise what is exposed to the internet and what runs on mod_php. Forgotten servers (staging, an old brochure site, a published internal tool) are the ones that get compromised first.
Who is affected?
- PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, 8.5 before 8.5.12
- PHP 7.4, 8.0 and 8.1: all versions, source or distribution fixes only
- PHP 7.3 and older, PHP 5 included: vulnerable, no fix
- Every web execution mode: mod_php (most exposed), PHP-FPM, php-cgi, FrankenPHP, LiteSpeed
- Exploitation observed since 21 October 2026, attempts from 17 October
How does AtriShield stop it?
Virtual patch (Business and Enterprise): the flaw is neutralised at the entrance of your server, without changing your application and without waiting for a maintenance window. Security metadata is reported to your console.
- ✓Virtual patch at the edge: multipart requests carrying the `PHP_SESSION_UPLOAD_PROGRESS` field are cut before PHP on routes that have no use for it.
- ✓Abnormal upload bodies (sheer volume, fields repeated en masse) aimed at exhausting PHP’s memory are dropped before they reach the engine.
- ✓One rule protects everything on the server (store, blog, back office, API), because it acts before PHP.
- ✓Updating PHP is still mandatory: no filter, at the edge or in the configuration, replaces the fix. The virtual patch covers the gap.
- ✓Attempts are logged and reported to your console: you know whether your servers were targeted, and since when.
Sources
- watchTowr - PHP2Shell FAQ: CVE-2026-109618 & CVE-2026-109619 Fixes
- BleepingComputer - PHP2Shell security flaws now successfully exploited in the wild
- Akamai - Understanding PHP2Shell: Everything You Need to Know
- Qualys - PHP2Shell: Find, Mitigate, and Patch Now
Analysis published by Atrilya Solutions, based on public security reporting. The links above point to the original sources.