{"slug": "php2shell-what-is-it-and-what-do-you-need-to-do", "title": "PHP2Shell. What is it and What Do You Need to Do?", "summary": "Two remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 (an out-of-memory corruption flaw) and CVE-2026-109619 (a stale global state flaw), affect every PHP version back to PHP 5.4, according to The PHP Foundation, which published an emergency security release on October 21, 2026. The PHP Foundation said full remote code execution was demonstrated with default settings on Apache with mod_php before any application code runs, and remote code execution was also confirmed on PHP-FPM through application-level code paths; the second flaw was demonstrated against a real-world application on Apache with mod_php. The NSA advised that \"Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,\" and the German Federal Ministry for Digital Transformation and Government Modernisation and France's Ministry of the Interior were among the bodies that took websites down until they could be patched.", "body_md": "# PHP2Shell. What is it and What Do You Need to Do?\n\nTime to read:\n\n**Written by**\n\n**Reviewed by**\n\n## [PHP2Shell. What is it and What Do You Need to Do?](#introduction)\n\nYou don't need to be a PHP developer or a systems administrator managing PHP-based software, to know about the recent PHP2Shell exploit:\n\n- Reports by [CBS News](https://www.cbsnews.com/news/php2shell-vulnerability-ai-security-flaw/) ,[the BBC](https://www.bbc.com/news/articles/c3qjnwye0ep5o) ,[Le Monde](https://www.lemonde.fr/pixels/article/2026/10/22/failles-php-pourquoi-ces-vulnerabilites-perturbent-votre-navigation-sur-internet_6798629_4408996) (French),[the Australian Broadcasting Corporation](https://www.abc.net.au/news/2026-10-22/data-breach-warning-after-ai-uncovers-critical-php-flaw/107295516) , on major news sites and podcasts, such as[Hacker News](https://news.ycombinator.com/item?id=50180836) ,[Bleeping Computer](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/) ,[Heise.de](http://Heise.de) (German),[The Times of India](https://timesofindia.indiatimes.com/technology/tech-news/php2shell-governments-on-high-alert-over-critical-website-flaw-wikipedia-hospitals-school-portals-go-dark-what-users-should-know/articleshow/135110798.cms) , and[ITWire](https://itwire.com/business-it-news/security/php2shell-vulnerability)\n- The [Japanese Prime Minister](https://japancyberwatch.com/articles/php2shell-critical-php-flaws-japan-services-pause-2026) mentioned it\n- The German Federal Ministry for Digital Transformation and Government Modernisation, and France’s Ministry of the Interior, among so many others around the world [took websites down](https://insiderpaper.com/websites-go-dark-worldwide-as-ai-exposes-critical-security-flaws/) until they could be patched\n- It is — *still* — all over social media, such as[the NSA posting](https://x.com/NSACyber/status/2112903220209098897) : \"*Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities* \"\n\nJust in case you missed it, [PHP2Shell](https://www.php2shell.com/) is a combination of two RCE (Remote Code Execution) exploits: [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/cve-2026-109618), which is an RCE via OOM (Out-Of-Memory) corruption, and [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/cve-2026-109619), which is an RCE via [stale global state](https://nhimg.org/glossary/stale-global-state/).\n\n[Citing The PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) (emphasis mine):\n\n**CVE-2026-109618:** If a request reached PHP's memory limit at exactly the wrong moment, PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with [mod_php](https://www.php.net/manual/en/security.apache.php), an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on [PHP-FPM](https://www.php.net/manual/en/install.fpm.php) through application-level code paths.\n\n**CVE-2026-109619:** A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request handled by the same worker could then use that freed memory. A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.\n\nBoth exploits **affect every version of PHP back to PHP 5.4!**\n\n## [How was it discovered?](#toc-heading-2f4f0186-db51-48f9-a57f-98d2384dcf4b)\n\nCVE-2026-109618 [was initially uncovered back in 2024](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), when one of the issues uncovered during an external security audit of PHP was being fixed. However, the exploit was never fixed for several reasons:\n\n1. The core team wasn't sure that it could be readily exploited\n2. Other issues were considered more pressing\n3. To fix the issue would likely cause backward-compatibility breaks, a significant amount of work for the resources available, and uncertainty around the impact of fixing it on the wider community\n\nThen, in 2026 during [OpenAI's Patch the Planet program](https://openai.com/index/patch-the-planet/), a more recent audit was conducted by two firms: Calif and Wiz. This audit resulted in discovering the earlier RCE, as well as the latter one, CVE-2026-109619. In addition, the firms showed how both exploits could be utilised, and their severity.\n\nTo talk specifics, both exploits are ranked a 9.2 out of a possible 10.0 on the [CVSS (Common Vulnerability Scoring System) 4.0](https://www.first.org/cvss/v4.0/), marking them critical. What's more, neither exploit needed a login. Both exploits can allow unauthenticated attackers to run code with the privileges of the PHP worker’s user, e.g., www-data.\n\nUnfortunately, before a coordinated effort to patch PHP could be completed, a proof-of-concept video was accidentally leaked. Keeping something of this severity a secret for too long is all but impossible.\n\nNot long after, updates of PHP for the four most recent versions were released, along with backports to PHP 8.1, 8.0, and 7.4. Even though the latter three versions are no longer supported, they were patched due to the impact of the exploits.\n\nGiven [all of the steps involved](https://www.exakat.io/from-commit-to-production-how-a-php-fix-actually-reaches-you/) between merging a change into PHP and it being available as an update, these patches were made available pretty quickly.\n\n## [Have the exploits been successfully exploited?](#toc-heading-455c96cd-a0d4-4594-9c90-04fbd8a287e1)\n\nYes! [Mallory confirmed that](https://mallory.ai/blog/php-rce-rapid-response) on October 26th:\n\nDream Research reported artifacts of a campaign that rooted 25 servers by chaining PHP2Shell with the Linux kernel privilege-escalation flaw Fragnesia (CVE-2026-46300).\n\nThis is in addition to Cloudflare, Imperva and Check Point reporting exploit attempts \"*in the hundreds of thousands to millions*\", as well as reports from [AWS](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/).\n\n## [What do you need to do?](#toc-heading-88f87ba4-eb30-40a7-9a50-fcd8cf43d3d7)\n\nIn order to stay safe from these security vulnerabilities, you’ll need to review any applications that utilise PHP. Follow the steps below to stay secure, making sure you check if any of your applications are using PHP, which you might have forgotten or missed.\n\n### [Step 1: Perform an inventory of all of your PHP-dependent code and installations](#toc-heading-32377940-ae8b-44ff-bc7d-5acaa853ee0e)\n\nAs PHP is so ubiquitous, don't look in just the obvious places, such as the software you're developing, or the software that you're administering that you know is based on PHP. Look everywhere.\n\nQuoting Steve Gibson from [episode 1102 of the Security Now podcast](https://twit.tv/shows/security-now/episodes/1102):\n\nI believe there will be systems which are forgotten, that are in the backroom, or as we often say on the podcast, in some dusty closet where they will not be updated. An attacker will be able to get in. It's also not the case, and we saw hints of this in some of the reporting that I shared, where the immediate proofs of concept are mature and robust and work regardless of PHP version.\n\nThere will likely be a large variety of places where you might find PHP in your organisation. For example:\n\n| Software Type | Available Software | \n|---|---|\n| CMS (Content Management Systems) | Wordpress, Drupal, TYPO3, Joomla, and Silverstripe | \n| E-commerce | Magento, WooCommerce, and OpenCart | \n| Frameworks | Laravel, CakePHP, Laminas, or Symfony | \n| Smart home platforms | Jeedom | \n| NAS (Network Attached Storage) devices | Some products from QNAP, Synology, Asustor, and Unraid | \n| Storage software | Nextcloud and OwnCloud | \n| Development stacks | XAMP, WAMP, and MAMP | \n| Bulletin board and forum software | Moodle and phpBB | \n| Business software | SugarCRM | \n| Web hosting software | Plesk, cPanel, and ISPConfig | \n\nCheck out [Mallory's PHP-based enterprise software guide](https://mallory.ai/blog/php-rce-rapid-response#products-that-run-php). The guide is broken down by task, such as phone systems, container and images, NAS and storage, and hosting control panels, making it super easy to follow.\n\nWhether you use a spreadsheet, an app, or pen and paper, make sure you take an inventory, and keep it regularly updated. If you don't know how to start, [I've created a Google Sheet](https://docs.google.com/spreadsheets/d/1X2BlmYtnVim0yIgC47dcs-rCkDJpcsVdjgQAjSxhngw/edit?gid=0#gid=0) to help you do so.\n\n### [Step 2: Upgrade PHP](#toc-heading-e613644e-0766-450d-97ea-bd6c3059b037)\n\nPHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 have been released, each of which contains the fix for the two exploits in question.Upgrade to the closest one as soon as you can.\n\nSource and binary downloads [are available](https://www.php.net/downloads.php?source=Y), and updated packages can be found in your Linux distribution's preferred package manager, e.g., APT, Yum, etc. In addition, even though they're no longer supported, fixes are also available for PHP 7.4, 8.0, and 8.1. If you're using containers, rebuild them using the relevant patched tag from the official sources, such as [Docker Hub](https://hub.docker.com/_/php/).\n\n#### [Step 2a: Configure PHP if you cannot upgrade](#toc-heading-bb6046e0-2c78-42e6-9c3e-20d37d721dbe)\n\nIt isn't always possible to upgrade, as projects may have dependencies that depend on earlier, unpatched versions of PHP. In these instances, there are still a number of settings you can tune to reduce the likelihood of being affected by one or both exploits.\n\nHere is a summary of  [the guidance from PHP.net](https://www.php.net/archive/2026.php#2026-10-21-5):\n\n **For CVE-2026-109618:**\n\n- Set  [memory_limit](https://www.php.net/manual/en/ini.core.php#ini.memory-limit) to`-1` .[php2shell.com](http://php2shell.com) recommends also using[Linux cgroup v2](https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2)`memory.max` (or an equivalent mechanism) to contain resource consumption and limit the impact to PHP processes. If you're using a container, consider setting[deploy.resources.limits.memory](https://docs.docker.com/reference/compose-file/deploy/#resources) to an applicable value, or check your host provider's documentation to see what resource limits they allow to be configured.\n- Set a low  [post_max_size](https://www.php.net/manual/en/ini.core.php#ini.post-max-size) value:\n- If one or more of your applications don't use file uploads, set it to 8M\n- If file uploads  *are* necessary, set it to 32M\n- Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable  [content-length header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Length) .\n- Keep the  [upload_max_filesize](https://www.php.net/manual/en/ini.core.php#ini.upload-max-filesize) value below that of`post_max_size`\n\n **For CVE-2026-109619:**\n\n- Set  [session.upload_progress.enabled](https://www.php.net/manual/en/session.configuration.php#ini.session.upload-progress.enabled) to`0` and restart all your workers\n- On PHP 8.5, set `fatal_error_backtraces` to`0` and restart the relevant workers\n- Remove invalid or deprecated settings applied per request that emit diagnostics before initialization\n- Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup\n- Ensure that  *php.ini* changes cannot be overridden by worker settings\n\nRestart all instances and workers to ensure that they're running the new configuration.\n\n## [What should you do going forward?](#toc-heading-aa4bee54-7148-429a-8f6c-1b528e1c1bc9)\n\nMatthew Weier O'Phinney from Perforce [recommends the following PHP security best practices](https://www.zend.com/blog/tips-php-security):\n\n1. **Always code with secure PHP in mind:**  Stay on top of[the OWASP Foundation](http://owasp.org/) 's (annual)[top ten web app security risks](https://owasp.org/www-project-top-ten/) .\n2. **Update all application components regularly:**  As was covered earlier, make sure you regularly update to the latest version of PHP.\n3. **Understand and document your existing infrastructure:**  To ensure no installation goes unpatched, and to reduce the work involved, do this on a regular basis.\n4. **Deploy hardened container images:**  Wherever possible, use hardened containers to ensure your PHP applications are as secure as possible, and save you the effort of increasing their security position.\n5. **Ensure your PHP infrastructure is properly configured** \n6. **Educate and train all employees in how to maintain secure PHP applications:**  Proper software development goes beyond just writing code. It includes secure coding practices such as avoiding[SQL injection attacks](https://www.php.net/manual/en/security.database.sql-injection.php) ,[securing PHP](https://www.php.net/manual/en/security.php) , i.e., having[secure sessions](https://www.php.net/manual/en/session.security.php) — and so much more. Make sure you include this as part of your standard developer training sessions.\n7. **Partner with third-party php security experts for additional support:**  No matter how large, diverse, or well-resourced an organisation is, it can always benefit from specialist, outside support. Budget-permitting, ensure you're using the expertise of security professionals to review your PHP code and configuration.\n\nAnd, I'll add one more, from [Damien Seguy](https://www.linkedin.com/in/damienseguy/), Senior PHP developer at Exakat: **Be ready to rebuild or update your installation at a moment's notice.** However, are you in a position to do so? How simple and trusted are your deployment procedures? This is the perfect time to review them,find out, and put plans in place to improve them, as required.\n\n### [Sponsor your favourite open source projects](#sponsor-your-favourite-open-source-projects)\n\nPHP forms the basis of so many commercial services and projects, ones which contribute significantly (or solely) to company bottom lines. But, despite this importance, it remains critically underfunded.\n\nAccording to The PHP Foundation's [Impact and Transparency Report 2025](https://thephp.foundation/blog/2026/05/27/impact-and-transparency-report-2025/) the total contributions received from sponsors and individual donors was $730,534 USD. Compared to the annual — even quarterly — revenues of companies in the S&P 500. [According to FatFIRE](https://fatfire.com/sp-500-revenue/), they generated roughly $18.3 trillion USD in trailing twelve-month revenue.\n\nIt would be great if those companies, and other companies and organisations who use PHP, would actually contribute to PHP (and other open source projects which they use). In the meantime, if you can, sponsor your favourite contributor, your favourite project, or [The PHP Foundation](https://thephp.foundation/sponsor/). And, whenever possible, advocate that your organisation or company do so as well.\n\nIt's a bit of a cliché, but if everyone chipped in just a little, it would go an incredibly long way.\n\nDespite a comparable lack of funding and resources, the PHP community has shown it is proactive in securing the web. That is demonstrated by how it responded to the PHP2Shell vulnerability in a calm, organized, and well-thought-out way. It was an excellent example of how to respond in these situations.\n\n## [Don't get complacent](#toc-heading-975f4454-4aeb-42a0-b9ab-89a1c2a340ef)\n\nBeing all over the news helped ensure that if you had any responsibility for a PHP or PHP-adjacent site, you knew that you had to take action straight-away — lest your site was hacked!\n\nHowever, like most things of this magnitude, there was initial attention — even hysteria — and then the news cycle moved on, as the graph below, from [Censys](https://php2shell.censys.com/) attests.\n\nHowever, this doesn't mean the problem has gone away. According to Censys, of the 46,272,123 PHP installations (those with known versions) that they identified as being affected on October 21, **29,311,837** are still affected at the time of writing.\n\nGladly, the services running newer, supported, versions of PHP have been patched. Unfortunately, services running PHP 8.1 and 7.4 are still affected.\n\nIf you haven't already, I strongly encourage you to perform a complete inventory of your systems and ensure they are patched. Then, perform an audit on a regular basis. By doing so and by following PHP security best practices, you should remain as prepared as possible for when the *next* exploit appears.\n\n## [Further reading](#further-reading)\n\n*Matthew Setter is a PHP and Go Editor in the Twilio Voices team. He’s also the author of [Mezzio Essentials](https://mezzioessentials.com/) and [Deploy with Docker Compose](https://deploywithdockercompose.com). You can find him at [msetter@twilio.com](mailto:msetter@twilio.com). He's also on [LinkedIn](https://www.linkedin.com/in/matthewsetter/) and [GitHub](https://github.com/settermjd).*\n\n## Related Posts\n\n## Related Resources\n\nTwilio Docs\n\nFrom APIs to SDKs to sample apps\n\nAPI reference documentation, SDKs, helper libraries, quickstarts, and tutorials for your language and platform.\n\nResource Center\n\nThe latest ebooks, industry reports, and webinars\n\nLearn from customer engagement experts to improve your own communication.\n\nAhoy\n\nTwilio's developer community hub\n\nBest practices, code samples, and inspiration to build communications and digital engagement experiences.", "url": "https://wpnews.pro/news/php2shell-what-is-it-and-what-do-you-need-to-do", "canonical_source": "https://www.twilio.com/en-us/blog/developers/tutorials/php2shell-what-is-it-what-do-you-need-to-do", "published_at": "2026-11-11 00:00:00+00:00", "updated_at": "2026-11-11 17:49:54.163178+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["PHP", "The PHP Foundation", "CVE-2026-109618", "CVE-2026-109619", "Apache", "mod_php", "PHP-FPM", "NSA"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/php2shell-what-is-it-and-what-do-you-need-to-do", "markdown": "https://wpnews.pro/news/php2shell-what-is-it-and-what-do-you-need-to-do.md", "text": "https://wpnews.pro/news/php2shell-what-is-it-and-what-do-you-need-to-do.txt", "jsonld": "https://wpnews.pro/news/php2shell-what-is-it-and-what-do-you-need-to-do.jsonld"}}