PHP Security Team Releases Urgent Patches for Critical Vulnerabilities

21 October 2026 4 min read هدهد تك | Hudhud Tech

The PHP security team has released emergency security patches for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell.

These unauthenticated RCE flaws were discovered by security researchers from Calif, Wiz, and OpenAI, and they impact all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

The PHP security team stated, “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”

Both vulnerabilities arise from the same underlying issue: PHP can leave its memory in a corrupted state when a request ends abnormally, allowing for remote code execution.

CVE-2026-109618 can be exploited to gain remote code execution as the web worker account by leveraging a chain of weaknesses that trigger out-of-memory corruption. Meanwhile, CVE-2026-109619 enables unauthenticated heap use-after-free, memory disclosure, and remote code execution with the web worker’s privileges.

Administrators are urged to install PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 on servers running PHP 8.x and to migrate to a fixed release if they are using PHP 7 or earlier.

The PHP developers noted, “PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.”

To assist users building from source or those without access to an LTS vendor, the PHP security team provided minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1.

Advanced Warning

This announcement follows a warning from PHP developers urging administrators to prepare for the installation of these security updates as soon as they are released. They stated, “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.”

PHP core developer Gina Peter Banyard cautioned that no mitigations for PHP2Shell would fully block potential attacks, emphasizing that applying the official security patches is the only permanent defense.

Before the patches were released, Cloudflare CTO Dane Knecht confirmed that the company had already observed early attacks targeting the two vulnerabilities, despite having deployed a set of WAF rules designed to block known PHP2Shell exploitation methods. Knecht stressed that these protections were temporary and urged all administrators to install the PHP security updates as soon as they become available.

The UK National Cyber Security Centre (NCSC) has also warned UK organizations to immediately update systems using PHP or take them offline until they can be patched.

Temporary Mitigation Measures

For those unable to immediately patch their servers, the PHP security team provided several mitigation measures to reduce exposure to some attack paths, although these do not fully protect against exploitation:

CVE-2026-109618: Set memory_limit=-1, preferably in a way applications can’t override, such as php_admin_value in the FPM pool or Apache configuration.
Set a low post_max_size: 8M for applications that don’t require file uploads, 32M if uploads are necessary.
Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker.

CVE-2026-109619: Set session.upload_progress.enabled=0 and restart every worker.
On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks only the confirmed fatal backtrace path.
Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors, or @ does not help.
Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing, and cleanup.

PHP (Hypertext Preprocessor) is an open-source, server-side web development language that powers 75% to 80% of all websites, including those using Content Management Systems (CMS) like WordPress, Joomla, and Drupal.

According to VirusTotal estimates, over 5.1 million PHP hosts are exposed online, with roughly 3.8 million having at least one port open.

Source: BleepingComputer

What do you think of this story?