PHP Vulnerabilities CVE-2026-109618 / CVE-2026-109619 (PHP2Shell): Critical RCE Actively Exploited

Summary

On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities that can allow unauthenticated remote code execution (RCE). Dubbed "PHP2Shell" by researchers, the flaws are not in a plugin but in PHP itself.

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): RCE via memory corruption during out-of-memory (OOM) handling.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): RCE via stale global state left over from a previous request (use-after-free).
• CVSS v4.0: 9.2, severity: Critical (the 10.0 score circulating on social media is wrong).
• Actively exploited: Yes. Amazon saw a first attempt on 17 October, four days before disclosure; PoCs appeared within hours of the patch.
• Remediation status: Patch released.

What is the flaw?

CVE-2026-109618: If a request hits PHP's memory_limit at exactly the wrong moment, PHP can leave partially initialised internal data behind and later treat it as valid, corrupting memory. Attackers can trigger this with crafted multipart (file upload) requests. According to PHP, on Apache with mod_php a single unauthenticated request can achieve RCE with default settings before any application code runs; RCE was also confirmed on PHP-FPM via application code paths.

CVE-2026-109619: After a fatal error, request-owned internal state can keep pointing to freed memory. A later request handled by the same worker may use that memory. RCE was demonstrated against a real-world application.

Who is affected?

According to PHP, every PHP installation serving web requests is at risk: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php at highest risk. In practice this covers WordPress, Joomla and Drupal sites, PHP-based e-commerce platforms, shared hosting (cPanel, Plesk) and VPS servers.

Affected and fixed versions

The PHP security team also published minimal source backports for 7.4, 8.0 and 8.1 for those building from source. Linux distributions received the patches in advance, so check your vendor's updated packages. The volunteer-run rpms.remirepo.net repository did not have updates on 21 October; PHP urges its users to switch to distribution packages or build from source. PHP 8.2 reaches end of life on 31 December 2026.

cPanel and Plesk

• cPanel (EasyApache 4): patched packages ea-php82 8.2.35, ea-php83 8.3.36, ea-php84 8.4.27, ea-php85 8.5.12; for EOL versions ea-php74 7.4.33-19, ea-php80 8.0.30-12, ea-php81 8.1.34-5. cPanel & WHM builds 11.110.0.153, 11.134.0.66, 11.136.0.50 and 11.138.0.18 are available. Restart PHP-FPM and Apache after updating.
• Plesk Obsidian: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are available for Linux and Windows. On Linux, 7.4.33, 8.0.30 and 8.1.34 keep the same version number; builds dated 21 October 2026 include the fix. Plesk's own PHP engine (sw-engine / plesk-engine) is also affected: update to Plesk Obsidian 18.0.80 Update 11 or 18.0.81 Update 4.
• Shared hosting: the fix must come from your hosting provider. Ask them to confirm the PHP build serving your site and that services were restarted.

Exploitation

Amazon Threat Intelligence detected an exploitation attempt on 17 October 2026, four days before disclosure. Multiple PoCs appeared on 21 October and attempts from different actors followed; according to Amazon, PHP2Shell is now being broadly exploited in the wild. CERT-EU also notes that PoCs are circulating and exploitation is likely.

Turkey: TR-26-1372

Turkey's Cyber Security Directorate (formerly USOM) published notice TR-26-1372 on 21 October 2026, recommending to:

• identify affected systems and upgrade them to secure versions without delay,
• restrict external access to management interfaces and critical PHP services to trusted IP addresses via firewall/ACL rules,
• immediately block international traffic to systems that do not need access from abroad.

If you cannot update immediately

According to PHP, only an update is a complete fix. The following measures merely narrow specific attack paths and do not make an installation safe:

For CVE-2026-109618

• Set memory_limit=-1 in a way applications cannot override (e.g. php_admin_value in the FPM pool or Apache config).
• Lower post_max_size: 8M if no uploads are needed, otherwise 32M; keep upload_max_filesize below it.
• Enforce limits on request size, field count, multipart parts and headers at the web server/proxy (including requests without a usable Content-Length).

For CVE-2026-109619

• Set session.upload_progress.enabled=0 in php.ini, the FPM pool or server config and restart all workers (ini_set() or .user.ini will not work).
• On PHP 8.5, set fatal_error_backtraces=0.

Review logs from 17 October

Because exploitation began before disclosure, Amazon recommends starting investigations from at least 17 October 2026. On internet-facing PHP servers, review web server and PHP-FPM logs for unexpected PHP worker crashes, unusually large multipart/POST requests, new or modified files (web shells) and new admin accounts.

Sources

• PHP security advisory (21 October 2026)
• GHSA-w8hw-w9fx-j79w – CVE-2026-109618
• GHSA-6wmf-4rv5-p3rp – CVE-2026-109619
• The PHP Foundation
• Amazon Threat Intelligence
• cPanel article
• Plesk article
• CERT-EU Security Advisory 2026-018
• Turkish Cyber Security Directorate, TR-26-1372 (siberguvenlik.gov.tr)

How can Doğa Network help?

We check which PHP version your website, hosting account or VPS runs, update it to a patched release, update your cPanel/Plesk servers and review your logs from 17 October onwards. For applications stuck on unsupported PHP versions, we prepare a migration plan.

📞 +90 850 888 3642 · ✉️ hi@doga.network