Projects
frontend.usefulLinks
frontend.officeAddress

Get in touch with us by filling contact form below

info@orhunajans.com

PHP2Shell: Urgent Mitigation Guide for the Critical PHP RCE (2026)

PHP2Shell: Urgent Mitigation Guide for the Critical PHP RCE (2026)
 Security
 
 31
Share :

A Heartbleed / Log4Shell-scale incident is unfolding in the PHP engine that powers roughly 70% of the web. The flaw is not in your WordPress plugin or Laravel app — it sits in PHP’s own memory management and error handling. Updating plugins or adding a WAF rule is not enough. You must upgrade the PHP runtime.

In this article
  1. What is PHP2Shell?
  2. Who is affected?
  3. Safe PHP versions
  4. 15-minute response plan
  5. Temporary mitigations
  6. Monitoring checklist
  7. FAQ
9.2CVSSv4 critical
(both CVEs)
~70%of websites run
on PHP
2 CVEsOOM corruption +
use-after-free
NowOnly complete fix:
patch immediately

What is PHP2Shell?

Discovered by researchers at Wiz, Calif and OpenAI (with AI-assisted analysis), these vulnerabilities stem from memory-safety issues in the PHP core that have existed for more than a decade. An unauthenticated attacker can craft HTTP requests to execute arbitrary code — and in some cases read passwords, tokens and API keys from process memory belonging to other requests.

Risk is highest on Apache with mod_php, where exploitation can be triggered before any application code runs. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected.

CVE-2026-109618

RCE via OOM corruption

If a request hits memory_limit at the wrong moment, partially initialized internal data can be left behind. Cleanup may treat it as valid, corrupting memory and enabling remote code execution.

CVE-2026-109619

RCE via stale global state

A fatal error can leave a worker pointing at memory from a previous request. A later request on the same worker then uses that freed memory (use-after-free) — RCE and memory disclosure confirmed.

Orhun Agency note: This is independent of your CMS. WordPress, Laravel, Magento or custom apps — if the PHP version is vulnerable, the risk is the same. Managed servers under our care have been prioritized for patching; if you self-host, follow the plan below immediately.

Who is affected?

  • Almost every PHP version since 5.4 Patches shipped for supported branches; 8.1 and older have no official release (source backports exist).
  • WordPress, Drupal, Joomla, Laravel, Magento… Secure application code does not help if the runtime is vulnerable. Plugin/theme updates do not fix these CVEs.
  • Hosting, VPS, shared servers, appliances Embedded PHP in devices and admin panels is also at risk.

Safe versions (upgrade here now)

Current branchStatusTarget version
PHP 8.5.x (< 8.5.12)Vulnerable8.5.12
PHP 8.4.x (< 8.4.27)Vulnerable8.4.27
PHP 8.3.x (< 8.3.36)Vulnerable8.3.36
PHP 8.2.x (< 8.2.35)Vulnerable8.2.35
PHP 7.4 – 8.1EOL / no officialSource backport or move to a supported branch
PHP ≤ 7.3EOL, no fixMigrate to supported PHP 8.x

15-minute response plan

  1. Identify the versionCheck the running PHP version via SSH or your hosting panel.php -v
    # or: <?php echo PHP_VERSION; ?>
  2. Upgrade to a patched releaseUse apt / yum / remi / ondrej PPA / CloudLinux selector / cPanel MultiPHP. If you use distro packages, follow your vendor advisory.
  3. Restart every PHP workerOtherwise old processes stay vulnerable.sudo systemctl restart php8.3-fpm
    sudo systemctl restart apache2 # or nginx + fpm
  4. VerifyConfirm the live version is patched. Smoke-test staging, then production.
  5. Hunt logs from 17 October onwardAmazon Threat Intelligence saw the first attempt on 17 October. Watch for workers spawning shells, unexpected outbound connections, new suspicious .php files, and sudden crash/OOM spikes.

Temporary mitigations before patching

Important: These reduce exposure but do not make an install safe. PHP states that updating is the only complete fix. If you cannot patch, isolate internet-facing systems.

  • CVE-2026-109618 Set memory_limit=-1 in a way apps cannot override. Side effect: weaker memory control.
  • CVE-2026-109619 Set session.upload_progress.enabled=0 and on PHP 8.5 fatal_error_backtraces=0. Restart all workers afterwards.
  • WAF (Cloudflare, etc.) Rules for known vectors are a stopgap only and only apply to traffic routed through the WAF.

Monitoring checklist

  • Worker → shell php-fpm / httpd spawning sh, bash, curl, wget.
  • New files in the web root Especially webshell .php files, hidden dirs, files changed after 17 October.
  • Abnormal request patterns Huge POST bodies, OOM-forcing requests, repeated fatal errors / worker crashes.

FAQ

My site is WordPress / Laravel — is a plugin update enough?
No. The flaw is in the PHP engine. Theme, plugin or framework updates do not close these CVEs. Upgrade the PHP runtime from your host panel or server.
I use shared hosting — what should I do?
Open a ticket with your provider immediately. If MultiPHP is available, select a patched version. If packages are missing, consider maintenance mode + WAF + isolation.
Does a WAF alone protect me?
No. It blocks known patterns only. New vectors and direct-to-origin traffic remain risky. Patching is mandatory.
What about legacy PHP 7.4 / 8.0 / 8.1?
No official binaries; minimal source backports were published. Apply vendor backports if available — long term, move to supported 8.2+.
Is exploitation happening in the wild?
Yes. Amazon, Cloudflare and watchTowr reported early / widespread attempts. The first attempt was seen on 17 October (four days before disclosure).

Need help patching PHP on your server?

Orhun Agency is prioritizing PHP2Shell remediation on managed projects. For your own server or hosting account we can help with version checks, safe upgrades and post-patch monitoring.

Get support

Sources: PHP Advisory · PHP Foundation · CISA · Wiz · NCSC-NL

Add New Comment