Critical PHP Security Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Published: October 22, 2026
Severity: Critical
CVSS v4.0 Score: 9.2
Affected Technology: PHP Runtime and PHP-based Web Applications

1. Overview

Two critical security vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been disclosed in the PHP runtime. Collectively referred to as PHP2Shell, these vulnerabilities may allow unauthenticated attackers to execute arbitrary code remotely or access sensitive information from PHP process memory.

Successful exploitation could lead to website compromise, unauthorized access to sensitive data, malicious file uploads, and service disruption.

Websites running vulnerable PHP versions are at risk. Administrators should identify affected systems and apply the appropriate security updates immediately.

2. Vulnerability Details

CVE-2026-109618 — Remote Code Execution

A memory corruption vulnerability associated with out-of-memory error handling can leave internal PHP structures in an inconsistent state. Under certain conditions, an attacker may exploit this issue to execute arbitrary code.

CVE-2026-109619 — Remote Code Execution

A use-after-free vulnerability involving stale internal state may allow references to previously freed memory to be reused during request processing, potentially resulting in arbitrary code execution.

Both vulnerabilities affect the PHP runtime itself rather than being limited to a particular content management system or website application.

3. Severity and Potential Impact

Potentially affected environments include:

• PHP-FPM
• Apache with mod_php
• php-cgi
• LiteSpeed PHP environments
• FrankenPHP
• Applications and platforms that rely on vulnerable PHP runtimes

The actual impact depends on the PHP version, server configuration, execution privileges, and application environment.

4. Affected PHP Versions

The following PHP release branches are affected when running versions earlier than the corresponding security fixes:

• PHP 8.5: Versions earlier than 8.5.12
• PHP 8.4: Versions earlier than 8.4.27
• PHP 8.3: Versions earlier than 8.3.36
• PHP 8.2: Versions earlier than 8.2.35

PHP 8.1 and older branches are also affected, but these versions are end-of-life and do not receive regular security fixes.

All php versions are also affected.

Websites running legacy PHP versions should be treated as a priority for remediation.

5. Fixed Versions

The PHP development team has released the following security updates:

Upgrade to the appropriate fixed release or a newer supported release compatible with your application.

Important: A Web Application Firewall (WAF) is an additional layer of protection, not a replacement for applying the PHP security update.

6. Recommended Mitigation and Remediation

Website owners and server administrators should take the following actions:

1. Update PHP: Upgrade vulnerable PHP installations to the appropriate fixed release or a newer supported version.
2. Review legacy applications: If an application cannot run on a supported PHP version, arrange for compatibility testing, application updates, or migration.
3. Enable WAF protection: Use a Web Application Firewall to help detect and block malicious HTTP requests and other web-based attacks.
4. Restrict access: Apply appropriate firewall rules, network segmentation, and IP allowlisting for administrative interfaces where feasible.
5. Review permissions: Ensure PHP processes and web server accounts operate with the minimum privileges required.
6. Inspect for compromise: Review relevant web server and PHP logs, investigate suspicious files or processes, and assess whether any compromise has occurred.
7. Maintain backups: Keep regular backups of website files, databases, and configurations, and verify that recovery procedures work.

For PHP 8.1 and older versions, upgrading to a currently supported PHP branch is strongly recommended because these legacy branches do not receive regular security fixes.

7. Additional Website Protection with Imunify360 WAF

A WAF can provide an additional security layer by inspecting incoming web traffic and helping block malicious requests targeting web applications.

HIOX customers can explore Imunify360 to add web application protection to their hosting environment.

Learn more about Imunify360: https://www.hioxindia.com/userinfo.php?products_id=imunify360

Enabling WAF protection does not eliminate the need to upgrade vulnerable PHP versions.

8. Official References

• PHP Security Release — October 21, 2026
• The PHP Foundation — Security Release and Security Improvements
• Wiz — PHP2Shell Vulnerability Analysis
• NHS England Digital — Critical PHP Vulnerabilities

9. Final Recommendation

All website owners and administrators should check their PHP versions and apply the appropriate security updates without delay. Websites that depend on unsupported PHP versions should prioritize migration to a supported release.

Additional protections, including WAF, access restrictions, least-privilege permissions, and regular security monitoring, can help reduce exposure and limit the impact of web-based attacks.

For HIOX customers who need assistance reviewing their PHP version or enabling additional website protection, please contact the HIOX Support Team.