PHP2Shell: What You Need to Know and How to Respond

On Wednesday, October 21, PHP released fixes for two critical remote code execution flaws in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. PHP rates each one CVSS v4.0 9.2 and says both can let an unauthenticated attacker run code on the server. Details leaked before the planned disclosure, and exploit code is already circulating.

PHP's release notes are direct: "There are no complete mitigations, updating is the only safe choice." Patch immediately, or take the service offline until you can.

Does this affect you? It does if you run PHP to serve web requests, through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed. PHP rates Apache with mod_php as the highest risk, but it has also validated remote code execution against PHP-FPM. Endpoints without PHP installed aren't affected.

Automox is aware of the two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) addressed by today's PHP security release. As a precaution, on the evening of October 20, we disabled the PHP features that public analysis ties to the vulnerable code across all Automox environments, including production. 

Automox immediately released the patched PHP version addressing both critical CVEs in today's PHP security release.

1. Find every PHP install. Check servers, container images that bundle PHP, vendor appliances, and internal tools such as wikis and dashboards. On Linux, run dpkg -l | grep -i php (Debian and Ubuntu) or rpm -qa | grep -i php (RHEL-family distributions).

2. Patch immediately, starting with internet-facing servers. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages. Windows builds are on PHP's downloads page. If you use Remi's repository, PHP says it won't have updates on October 21, so switch to distribution packages or build from source. On managed or shared hosting, ask your provider when a fixed build will be available.

3. Confirm your package has the fix. Distribution packages carry their own version numbers, so search the package changelog for the CVE instead: apt changelog php8.3-fpm | grep CVE-2026-109618 or rpm -q --changelog php-fpm | grep CVE-2026-109618. Use the PHP package name on your system.

4. Restart PHP. PHP-FPM and Apache mod_php keep the old code in memory until they restart, so an upgrade without a restart leaves the vulnerable code running. Restart PHP-FPM (for example, systemctl restart php8.3-fpm) or Apache. Then run ps -eo pid,lstart,cmd | grep -E '[p]hp-fpm|[a]pache2|[h]ttpd'. A process that started before the upgrade is still running the old code.

5. Take the service offline if you can't patch yet. Maintenance mode isn't enough, because PHP still parses every request. Stop PHP-FPM, or Apache if it runs mod_php, and serve a static page until the server is patched.

6. Move PHP 8.1 and older to a supported branch. The PHP project no longer updates these versions. Some distributions and LTS vendors backport the fix, so check with yours, or upgrade to 8.2 or later. PHP also published minimal source backports for 7.4, 8.0, and 8.1 for teams that build from source. Until then, keep the service offline.

7. Check servers that were exposed. Patching doesn't remove an attacker who's already on a server. Look for processes the web server or PHP-FPM user doesn't normally run, such as sh, bash, curl, or wget. Also look for new or modified PHP files in web roots and upload directories.

• Disabling session.upload_progress.enabled. PHP's advisory says this blocks the confirmed session paths but not other variants, and that none of its interim settings make an installation safe. PHP 8.6 release manager Joe Ferguson says "ini settings won't save you."

• Web application firewall (WAF) rules. Cloudflare CTO Dane Knecht calls Cloudflare's emergency rules "a stopgap." WAFs parse multipart requests differently from PHP, which leaves room for evasion.

• Patch PHP with a dedicated policy. If your Linux endpoints install PHP from an enabled package repository, a patch policy that targets PHP packages installs the fixed builds through the OS package manager once your repository mirror carries them. Run it manually instead of waiting for the next scheduled window.

• Restart after patching. Patch policies don't restart running services, so restart PHP-FPM or Apache after the policy runs.

• Upgrade other installs by hand. Patch policies don't update PHP installed outside an enabled Linux repository, such as manual installs on Windows or builds from source.

• CVE-2026-109618, remote code execution through out-of-memory corruption. Out-of-memory handling can interrupt PHP while internal request data is only partly initialized. Request cleanup may then treat the invalid data as valid.

• CVE-2026-109619, remote code execution through stale global state. Internal state that belongs to a request can survive after its memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

• Exploitation. PHP says it has a demonstrated exploit against Apache with mod_php in which an unauthenticated request can trigger the attack before any application code runs. Its advisory for CVE-2026-109619 also validates remote code execution against PHP-FPM. Cloudflare reported early attacks against PHP sites at 3:43 am ET on October 21. Shortly after the release, Patchstack's telemetry showed probing but no confirmed breaches. Neither CVE was in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of writing.

1. PHP: Security advisory, critical remote code execution vulnerabilities

2. GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)

3. GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)

4. PHP: Upcoming Critical PHP Security Release

5. Sansec: Critical PHP RCE, CVE-2026-109618 and CVE-2026-109619

6. The Hacker News: PHP2Shell, What Actually Protects You Before the 14:00 UTC PHP RCE Patch

7. Patchstack: Major security alert, PHP vulnerable to critical RCE