The vulnerabilities were leaked one day before the embargo. Cloudflare reports attack traffic even before the patch was released. With public advisories, research write-ups, and exploit tools available, active exploitation is a very real possibility. Both flaws reside in the PHP engine, not in the application itself. This means that even applications with securely written code can be affected by these vulnerabilities.
Tuesday, October 20, 2026: Information about the vulnerabilities is published on Hacker News (later deleted); watchTowr confirms the vulnerabilities; PHP announces a security release; CERT-EU publishes Advisory 2026-018.
According to PHP, all versions prior to the aforementioned fix releases are affected. Cloudflare and Sansec trace relevant code paths back to PHP 5.4.0. Installations that process web requests are at risk: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Researchers cite Magento, WordPress, Drupal, Joomla, Nextcloud, Laravel, and Symfony, among others, as affected applications or frameworks. Crucially, even an application developed without errors can be affected.
Both CVEs arise because PHP fails to safely clean up a request after a fatal error—often caused by out-of-memory (OOM) conditions:
Impact according to PHP: Unauthenticated attackers can execute code in the context of the web worker and read memory contents (memory disclosure). We have deliberately omitted a detailed description of the exploit mechanics.
Prioritization: First mod_php, then FrankenPHP, FPM, LiteSpeed, and php-cgi. Anything that processes multipart/form-data represents a potential attack vector. Disabling upload progress alone is not sufficient, as this addresses only one of the attack vectors for CVE-2026-109619.
Supported PHP versions: Update to the four patched versions or install the corresponding distribution backports. Be sure to check the CVE IDs in the changelog, as backports often retain the original version number.
Remi Repository: PHP notes that rpms.remirepo.net does not yet provide updates as of this publication. If necessary, fall back on distribution packages or the source code.
End-of-Life Versions: Isolate or update affected systems. Use WAF rules only as a temporary protective measure. Cloudflare notes that the request alone is often insufficient for reliable detection.
Official PHP workarounds: These reduce the attack surface but do not fix the vulnerabilities. Set `memory_limit=-1` administratively and make it non-overwritable; configure `session.upload_progress.enabled=0`; for PHP 8.5, additionally set `fatal_error_backtraces=0`; keep `post_max_size` low; and, if necessary, block multipart requests at the proxy. Remove obsolete request-specific PHP settings. Do not use RLIMIT_AS and RLIMIT_DATA as memory limits, as this can trigger the vulnerable code path according to PHP. Then restart all workers.
Without a patch or effective interim measures: Temporarily take publicly accessible applications offline, as recommended by CERT-EU. An application maintenance mode is not sufficient, as PHP processes the request beforehand.
Possible indications of php2shell attack attempts (based on advisories and research; often not very meaningful when considered individually, so correlate by client IP and time):
Multipart POST requests followed by memory limit errors (“Allowed memory size … exhausted”) or frequent HTTP 500 errors
Unusually large or malformed PHPSESSID cookies in responses (indicating memory disclosure, even without RCE)
Unusually frequent worker restarts or crashes: php-fpm child processes terminate, Apache segfaults (AH00052)
Deprecation warnings or other warning messages before application scripts are executed (request-specific INI settings)
Indicators of a successful compromise unrelated to vulnerabilities (particularly meaningful signals based on practical experience and threat hunting / Florian Roth):
PHP or web server processes launch sh, bash, cmd, PowerShell, curl, wget, nc, or other interpreters and download tools
New or modified .php files in upload directories and web roots
Unexpected outbound connections from the PHP user account
Indications of persistence via cron, systemd, authorized_keys, auto_prepend_file, or Windows tasks/services
Use your existing EDR/SIEM queries for the “Web worker launches a shell” scenario on Windows and Linux. However, no hits do not necessarily indicate security: PHP notes that errors may occur before logging takes place.
Isolate the system and secure evidence: Disconnect from the network without prematurely destroying potential traces. Don’t just “patch and hope.”
Back up ephemeral data first: Capture the process tree, including command lines, open network connections, and memory dumps. Then back up logs (Access, Error, FPM, Journal, WAF/CDN).
Back up the web root: Capture files, including hash values, as well as upload directories, /tmp, and /dev/shm. Compare with the latest deployment or Git commit.
Determine the extent of the compromise: Trace the timing of the first detectable malicious activity as far back as the available logs allow. Do not start searching only from the date of the leak.
Rotate credentials and secrets: Renew all credentials that the PHP process could access (database, API, SMTP, APP_KEY, cloud credentials). This also applies in cases of memory disclosure without clear evidence of RCE.
Restore systems to a trusted state: Prefer a fresh build from a provably trusted image or codebase. Restore data from backups, but obtain application code from a trusted source.
php2shell once again highlights the risks posed by incomplete system inventories, outdated PHP versions, and a lack of visibility on web servers.
Patch your affected systems immediately and then conduct a targeted search for possible signs of an attack. Be sure to document any previously unknown or overlooked PHP installations as well.
If you suspect a compromise, InfoGuard’s experienced incident response team is available 24/7. We’re here to help!
Sources:
• PHP Security Advisory & Releases 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (October 21, 2026): https://www.php.net/
• GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp
• CERT-EU Security Advisory 2026-018: https://cert.europa.eu/publications/security-advisories/2026-018
• Huntress – php2shell: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
• Sansec – php2shell: https://sansec.io/research/php2shell
• Cloudflare – Early attack traffic / WAF (via public reports from October 21, 2026)
• English Deep Dive (Mathias Fuchs): https://medium.com/@mathias.fuchs/brace-for-impact-php2shell-114912dedeb4
Caption: AI-generated image